HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: assertion failure in Range header processing (SQUID-2014:2) (CVE-2014-3609)

  - squid: off-by-one error in snmpHandleUdp() leading to a bss-based buffer overflow (SQUID-2014:3)     (CVE-2014-6270)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

CVE-2014-3609: Denial of Service in Range header processing.

Ignore Range headers with unidentifiable byte-range values. If squid is unable to determine the byte value for ranges, treat the header as invalid.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated squid packages fix security vulnerabilities :

Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing certain HTTPS requests if the SSL-Bump feature is enabled (CVE-2014-0128).

Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service (CVE-2014-3609).

Due to incorrect buffer management Squid can be caused by an attacker to write outside its allocated SNMP buffer (CVE-2014-6270).

Due to incorrect bounds checking Squid pinger binary is vulnerable to denial of service or information leak attack when processing larger than normal ICMP or ICMPv6 packets (CVE-2014-7141).

Due to incorrect input validation Squid pinger binary is vulnerable to denial of service or information leak attacks when processing ICMP or ICMPv6 packets (CVE-2014-7142).

Matthew Daley discovered that squid, a web proxy cache, does not properly perform input validation when parsing requests. A remote attacker could use this flaw to mount a denial of service attack, by sending specially crafted Range requests.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. (CVE-2014-0128)

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.3.13 or 3.4.7. It is, therefore, affected by a denial of service vulnerability.

The flaw exists due to user-supplied input not being properly validated in request parsing. This allows a remote attacker to specially craft a request with Range headers with unidentifiable byte-range values to crash the application.

Note that Nessus has relied only on the version in the proxy server's banner. The patch released to address the issue does not update the version in the banner. If the patch has been applied properly, and the service has been restarted, consider this to be a false positive.

Security fix for CVE-2014-3609

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues and bugs with squid :

A denial of Service in Range header processing was fixed that could be used by proxy users to crash squid. (CVE-2014-3609)

Also the following bugs were fixed :

  - bnc#894840: removed unnecessary 'sharedscripts' in     squid's logrotate snippet

  - bnc#894636: fixes run of init script when logrotate is     called

Squid3 was updated to fix a denial of service in Range Header processing, which would have allowed proxy users to crash the squid proxy process. (CVE-2014-3609)

Updated squid packages fix security vulnerability :

Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service (CVE-2014-3609).

Squid versions prior to 3.3.13 and 3.4.7 are potentially affected by a denial of service vulnerability due to an error in the 'src/HttpHdrRange.cc' file.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

After installing this update, the squid service will be restarted automatically.

An updated squid package that fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

Red Hat would like to thank the Squid project for reporting the CVE-2014-3609 issue. Upstream acknowledges Matthew Daley as the original reporter.

All Squid users are advised to upgrade to this updated package, which contains backported patches to correct these issues. After installing this update, the squid service will be restarted automatically.

Updated squid packages that fix one security issue are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

Red Hat would like to thank the Squid project for reporting this issue. Upstream acknowledges Matthew Daley as the original reporter.

All Squid users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically.

The remote Oracle Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2014-1148 advisory.

    - Resolves: #1134936 - CVE-2013-4115 buffer overflow when processing overly long DNS names

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-1147 advisory.

    [7:3.3.8-12]
    - Resolves: #1134933 - CVE-2014-3609 assertion failure in header processing

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Matthew Daley discovered that Squid3, a fully featured web proxy cache, did not properly perform input validation in request parsing. A remote attacker could use this flaw to mount a denial of service by sending crafted Range requests.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2327-1 advisory.

    Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A     remote attacker could send crafted Range requests to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198516	RHEL 4 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
83168	Debian DLA-216-1 : squid security update	Nessus	Debian Local Security Checks	medium
82356	Mandriva Linux Security Advisory : squid (MDVSA-2015:103)	Nessus	Mandriva Local Security Checks	medium
82192	Debian DLA-45-1 : squid3 security update	Nessus	Debian Local Security Checks	medium
81006	Debian DSA-3139-1 : squid - security update	Nessus	Debian Local Security Checks	medium
78658	Amazon Linux AMI : squid (ALAS-2014-433)	Nessus	Amazon Linux Local Security Checks	high
78354	Amazon Linux AMI : squid (ALAS-2014-411)	Nessus	Amazon Linux Local Security Checks	high
77985	Squid 3.x < 3.3.13 / 3.4.7 Request Processing DoS	Nessus	Firewalls	medium
77799	Fedora 21 : squid-3.4.7-1.fc21 (2014-9882)	Nessus	Fedora Local Security Checks	medium
77777	openSUSE Security Update : squid (openSUSE-SU-2014:1144-1)	Nessus	SuSE Local Security Checks	medium
77743	SuSE 11.3 Security Update : squid3 (SAT Patch Number 9729)	Nessus	SuSE Local Security Checks	medium
77656	Mandriva Linux Security Advisory : squid (MDVSA-2014:177)	Nessus	Mandriva Local Security Checks	medium
8384	Squid 3.3.x < 3.3.13 / 3.4.x < 3.4.7 Request Parsing Vulnerability	Nessus Network Monitor	Web Servers	medium
77617	Fedora 19 : squid-3.3.13-1.fc19 (2014-9963)	Nessus	Fedora Local Security Checks	medium
77559	Fedora 20 : squid-3.3.13-1.fc20 (2014-9948)	Nessus	Fedora Local Security Checks	medium
77553	Scientific Linux Security Update : squid on SL5.x, SL6.x i386/x86_64 (20140903)	Nessus	Scientific Linux Local Security Checks	high
77523	RHEL 5 / 6 : squid (RHSA-2014:1148)	Nessus	Red Hat Local Security Checks	high
77522	RHEL 7 : squid (RHSA-2014:1147)	Nessus	Red Hat Local Security Checks	medium
77517	Oracle Linux 5 / 6 : squid (ELSA-2014-1148)	Nessus	Oracle Linux Local Security Checks	high
77516	Oracle Linux 7 : squid (ELSA-2014-1147)	Nessus	Oracle Linux Local Security Checks	high
77509	CentOS 5 / 6 : squid (CESA-2014:1148)	Nessus	CentOS Local Security Checks	high
77508	CentOS 7 : squid (CESA-2014:1147)	Nessus	CentOS Local Security Checks	medium
77422	Debian DSA-3014-1 : squid3 - security update	Nessus	Debian Local Security Checks	medium
77420	Ubuntu 14.04 LTS : Squid 3 vulnerability (USN-2327-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2014-3609

high

Tenable Plugins

high

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium

high

high

high

medium

medium

high