Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: buffer overflow in cachemgr.cgi (CVE-2016-4051)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

  - Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x     before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory     consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication     credentials. (CVE-2012-5643)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: Heap overflow issue in URN processing (CVE-2019-12526)

  - Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is     configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary     code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow. (CVE-2014-6270)

  - Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote     authenticated users to retain access by leveraging a stale nonce, aka Nonce replay vulnerability.
    (CVE-2014-9749)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: assertion failure in Range header processing (SQUID-2014:2) (CVE-2014-3609)

  - squid: off-by-one error in snmpHandleUdp() leading to a bss-based buffer overflow (SQUID-2014:3)     (CVE-2014-6270)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code     execution (CVE-2020-11945)

  - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - Regression caused by the DoS fixes above (bsc#993299)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201607-01 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2921-1 advisory.

    Sebastian Krahmer discovered that Squid incorrectly handled certain SNMP requests. If SNMP is enabled, a     remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2014-6270)

    Alex Rousskov discovered that Squid incorrectly handled certain malformed responses. A remote attacker     could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2016-2571)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

squid was updated to fix two security issues.

These security issues were fixed :

  - CVE-2014-6270: Fixed an off by one in snmp subsystem     (bsc#895773).

  - CVE-2014-9749: Fixed a nonce replay vulnerability in     Digest authentication (bsc#949942).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This squid updated fixes the following security update.

  - bnc#895773: fix off-by-one in snmp subsystem     (CVE-2014-6270)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated squid packages fix security vulnerabilities :

Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing certain HTTPS requests if the SSL-Bump feature is enabled (CVE-2014-0128).

Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service (CVE-2014-3609).

Due to incorrect buffer management Squid can be caused by an attacker to write outside its allocated SNMP buffer (CVE-2014-6270).

Due to incorrect bounds checking Squid pinger binary is vulnerable to denial of service or information leak attack when processing larger than normal ICMP or ICMPv6 packets (CVE-2014-7141).

Due to incorrect input validation Squid pinger binary is vulnerable to denial of service or information leak attacks when processing ICMP or ICMPv6 packets (CVE-2014-7142).

Versions of Squid 3.4.x prior to 3.4.8 are potentially affected by by the following vulnerabilities :

  - An off-by-one overflow flaw exists within the SNMP processing component. By using a specially crafted UDP SNMP request, a remote attacker could exploit this to cause a denial of service or possibly execute arbitrary code. (CVE-2014-6270)

  - There exists an array indexing flaw in the node pinger that is triggered when parsing ICMP and ICMPv6 replies, which may allow a remote attacker to crash the pinger or obtain sensitive information. (CVE-2014-7141)

  - The node pinger has a flaw in function 'Icmp4::Recv' in file 'icmp/Icmp4.cc' that is triggered when parsing ICMP or ICMPv6 responses. A remote attacker could exploit this to crash the pinger or obtain sensitive information. (CVE-2014-7142)

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.4.8. Therefore, it may be affected by the following vulnerabilities :

  - A off-by-one overflow flaw exists within the SNMP     processing component. By using a specially crafted     UDP SNMP request, a remote attacker could exploit this     to cause a denial of service or possibly execute     arbitrary code. (CVE-2014-6270)

  - There exists an array indexing flaw in the node pinger     that is triggered when parsing ICMP and ICMPv6 replies,     which may allow a remote attacker to crash the pinger or     obtain sensitive information. (CVE-2014-7141)

  - The node pinger has a flaw in function 'Icmp4::Recv' in     file 'icmp/Icmp4.cc.' that is triggered when parsing     ICMP or ICMPv6 responses. A remote attacker could     exploit this to crash the pinger or obtain sensitive     information. (CVE-2014-7142)

Note that Nessus has relied only on the version in the proxy server's banner. The patch released to address the issue does not update the version in the banner. If the patch has been applied properly, and the service has been restarted, consider this to be a false positive.

This updated fixes CVE-2014-6270.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The squid-cache project reports :

Due to incorrect buffer management Squid can be caused by an attacker to write outside its allocated SNMP buffer.

ID	Name	Product	Family	Severity
198537	RHEL 5 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198536	RHEL 7 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198516	RHEL 4 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198515	RHEL 6 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
93294	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:2089-1)	Nessus	SuSE Local Security Checks	high
93271	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)	Nessus	SuSE Local Security Checks	high
91982	GLSA-201607-01 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
89734	Ubuntu 14.04 LTS : Squid vulnerabilities (USN-2921-1)	Nessus	Ubuntu Local Security Checks	high
86883	SUSE SLES11 Security Update : squid (SUSE-SU-2015:1983-1)	Nessus	SuSE Local Security Checks	medium
83662	SUSE SLES12 Security Update : squid (SUSE-SU-2015:0028-1)	Nessus	SuSE Local Security Checks	medium
82356	Mandriva Linux Security Advisory : squid (MDVSA-2015:103)	Nessus	Mandriva Local Security Checks	medium
8634	Squid 3.x < 3.4.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
79742	Squid 3.x < 3.4.8 Multiple Vulnerabilities	Nessus	Firewalls	medium
78400	Fedora 19 : squid-3.3.13-2.fc19 (2014-10794)	Nessus	Fedora Local Security Checks	medium
78399	Fedora 20 : squid-3.3.13-2.fc20 (2014-10790)	Nessus	Fedora Local Security Checks	medium
78398	Fedora 21 : squid-3.4.7-2.fc21 (2014-10767)	Nessus	Fedora Local Security Checks	medium
77753	FreeBSD : squid -- Buffer overflow in SNMP processing (d3324c55-3f11-11e4-ad16-001999f8d30b)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-6270

high

Tenable Plugins

high

critical

high

critical

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium