Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - Regression caused by the DoS fixes above (bsc#993299)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated squid packages fix security vulnerabilities :

Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing certain HTTPS requests if the SSL-Bump feature is enabled (CVE-2014-0128).

Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service (CVE-2014-3609).

Due to incorrect buffer management Squid can be caused by an attacker to write outside its allocated SNMP buffer (CVE-2014-6270).

Due to incorrect bounds checking Squid pinger binary is vulnerable to denial of service or information leak attack when processing larger than normal ICMP or ICMPv6 packets (CVE-2014-7141).

Due to incorrect input validation Squid pinger binary is vulnerable to denial of service or information leak attacks when processing ICMP or ICMPv6 packets (CVE-2014-7142).

The remote host is affected by the vulnerability described in GLSA-201411-11 (Squid: Multiple vulnerabilities)

    An assertion failure in processing of SSL-Bump has been found in Squid.
      Heap based overflow is discovered when processing SNMP requests.
  Impact :

    A remote attacker could send a specially crafted request, possibly       resulting in a executing of arbitrary code or Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. (CVE-2014-0128)

A denial of service flaw was found in the way Squid processed certain HTTPS requests when the SSL Bump feature was enabled. A remote attacker could send specially crafted requests that could cause Squid to crash. (CVE-2014-0128)

Squid versions prior to 3.3.12 and 3.4.4 are potentially affected by a denial of service vulnerability due to a state management error within SSL-Bump.

The SSLBump feature acts as TLS/SSL termination for clients. If this feature is enabled, squid can crash with range requests, leading to a potential Denial of Service condition.

Updated squid packages fix security vulnerability :

Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing certain HTTPS requests if the SSL-Bump feature is enabled (CVE-2014-0128).

Updated squid packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A denial of service flaw was found in the way Squid processed certain HTTPS requests when the SSL Bump feature was enabled. A remote attacker could send specially crafted requests that could cause Squid to crash. (CVE-2014-0128)

Red Hat would like to thank the Squid project for reporting this issue. Upstream acknowledges Mathias Fischer and Fabian Hugelshofer from Open Systems AG as the original reporters.

All squid users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically.

A denial of service flaw was found in the way Squid processed certain HTTPS requests when the SSL Bump feature was enabled. A remote attacker could send specially crafted requests that could cause Squid to crash. (CVE-2014-0128)

After installing this update, the squid service will be restarted automatically.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2014-0597 advisory.

    - Resolves: #1098134 - CVE-2014-0128 squid: denial of service when using       SSL-Bump

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A remote DoS attack in the Squid web proxy has been fixed.

Due to incorrect state management, Squid was vulnerable to a denial of service attack when processing certain HTTPS requests. (CVE-2014-0128)

For more information see http://www.squid-cache.org/Advisories/SQUID-2014_1.txt .

Additionally, a bug in the logrotate configuration file has been fixed. The 'su' statement was moved into the 'logfile' section.
(bnc#677335)

Use the version from Fedora 20.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream version with a security fix.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.3.12 or 3.4.4 and is, therefore, affected by a denial of service vulnerability. 

A flaw exists in SSL-Bump in regards to the state management when processing range requests.  A remote attacker can cause the server to crash with specially crafted HTTPS requests. 

Note that Nessus has relied only on the version in the proxy server's banner, which is not updated by the patch the project has released to address the issue.  If this patch has been applied properly and the service has been restarted, consider this to be a false positive.

ID	Name	Product	Family	Severity
93294	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:2089-1)	Nessus	SuSE Local Security Checks	high
93271	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)	Nessus	SuSE Local Security Checks	high
82356	Mandriva Linux Security Advisory : squid (MDVSA-2015:103)	Nessus	Mandriva Local Security Checks	medium
79609	GLSA-201411-11 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
78658	Amazon Linux AMI : squid (ALAS-2014-433)	Nessus	Amazon Linux Local Security Checks	high
78303	Amazon Linux AMI : squid (ALAS-2014-360)	Nessus	Amazon Linux Local Security Checks	medium
8383	Squid 3.3.x < 3.3.12 / 3.4.x < 3.4.4 Remote DoS	Nessus Network Monitor	Web Servers	medium
75329	openSUSE Security Update : squid (openSUSE-SU-2014:0559-1)	Nessus	SuSE Local Security Checks	medium
74447	Mandriva Linux Security Advisory : squid (MDVSA-2014:114)	Nessus	Mandriva Local Security Checks	medium
74312	CentOS 6 : squid (CESA-2014:0597)	Nessus	CentOS Local Security Checks	medium
74308	Scientific Linux Security Update : squid on SL6.x i386/x86_64 (20140603)	Nessus	Scientific Linux Local Security Checks	medium
74304	RHEL 6 : squid (RHSA-2014:0597)	Nessus	Red Hat Local Security Checks	medium
74299	Oracle Linux 6 : squid (ELSA-2014-0597)	Nessus	Oracle Linux Local Security Checks	high
73708	SuSE 11.3 Security Update : squid3 (SAT Patch Number 9138)	Nessus	SuSE Local Security Checks	medium
73544	Fedora 19 : squid-3.3.12-1.fc19 (2014-4800)	Nessus	Fedora Local Security Checks	medium
73311	Fedora 20 : squid-3.3.12-1.fc20 (2014-3915)	Nessus	Fedora Local Security Checks	medium
73131	Squid 3.1.x < 3.3.12 / 3.4.4 HTTPS Request Handling DoS	Nessus	Firewalls	medium

Detections

Analytics

CVE-2014-0128

high

Tenable Plugins

high

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium