Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: buffer overflow in cachemgr.cgi (CVE-2016-4051)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

  - Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x     before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory     consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication     credentials. (CVE-2012-5643)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: Heap overflow issue in URN processing (CVE-2019-12526)

  - Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is     configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary     code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow. (CVE-2014-6270)

  - Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote     authenticated users to retain access by leveraging a stale nonce, aka Nonce replay vulnerability.
    (CVE-2014-9749)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code     execution (CVE-2020-11945)

  - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - Regression caused by the DoS fixes above (bsc#993299)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues :

  - Fixed multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2015-5400: Improper protection of alternate path.
    (bsc#938715)

  - CVE-2015-3455: Squid http proxy configured with     client-first SSL bumping did not correctly validate     server certificate. (bsc#929493)

  - CVE-2016-3948: Fixed denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: Fixed     multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4553: Fixed cache poisoning issue in HTTP     Request handling (bsc#979009)

  - CVE-2016-4554: Fixed header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fixed multiple Denial of Service issues in ESI Response     processing. (CVE-2016-4555, CVE-2016-4556, bsc#979011,     bsc#979008)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues :

  - Fixed multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2015-5400: Improper protection of alternate path.
    (bsc#938715)

  - CVE-2015-3455: Squid http proxy configured with     client-first SSL bumping did not correctly validate     server certificate. (bsc#929493)

  - CVE-2016-3948: Fixed denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: Fixed     multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4553: Fixed cache poisoning issue in HTTP     Request handling (bsc#979009)

  - CVE-2016-4554: Fixed header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fixed multiple Denial of Service issues in ESI Response     processing. (CVE-2016-4555, CVE-2016-4556, bsc#979011,     bsc#979008)

Additionally, the following non-security issues have been fixed :

  - Fix header size in script unsquid.pl. (bsc#902197)

  - Add external helper ext_session_acl to package.
    (bsc#959290)

  - Update forward_max_tries to permit 25 server paths With     cloud sites becoming more popular more CDN servers are     producing long lists of IPv6 and IPv4 addresses. If     there are not enough paths selected the IPv4 ones may     never be reached.

  - squid.init: wait that squid really dies when we kill it     on upgrade instead of proclaiming its demise prematurely     (bnc#963539)

This update was imported from the SUSE:SLE-12:Update update project.

Security fix for CVE-2016-2571, CVE-2016-2572 ---- squid-3.4.13-3.fc22
- Resolves: #1231992 ---- Security fix for #1240741, #1240744 Updated to version 3.4.13, which fixes CVE-2015-3455

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Squid 3.x prior to 3.5.6 are potentially affected by by the following vulnerabilities :

  - An authentication bypass vulnerability exists due to a flaw in file 'tunnel.cc', which is triggered whenever cache peer CONNECT responses are blindly forwarded in a hierarchy of two or more proxies, resulting in unrestricted access to a back-end proxy through its gateway proxy. A remote, unauthenticated attacker, using a specially crafted request, can exploit this vulnerability to bypass authentication or gain access to protected resources. This issue occurs in configurations with cache_peer enabled, and exploitation would require that the two proxies have differing levels of security. (CVE-2015-5400)
 - A flaw in 'ssl/support.cc' that is triggered during the handling of repeated client-initiated TLS renegotation messages. This may allow a remote attacker to cause a denial of service.

Alex Rousskov of The Measurement Factory discovered that Squid3, a fully featured web proxy cache, does not correctly handle CONNECT method peer responses when configured with cache_peer and operating on explicit proxy traffic. This could allow remote clients to gain unrestricted access through a gateway proxy to its backend proxy.

Alex Rousskov discovered that Squid configured with cache_peer and operating on explicit proxy traffic does not correctly handle CONNECT method peer responses. In some configurations, it allows remote clients to bypass security in an explicit gateway proxy.

For Debian 6 Squeeze, this problem has been fixed in squid3 version 3.1.6-1.2+squeeze5. We recommend that you upgrade your squid3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Squid security advisory 2015:2 reports :

Squid configured with cache_peer and operating on explicit proxy traffic does not correctly handle CONNECT method peer responses.

The bug is important because it allows remote clients to bypass security in an explicit gateway proxy.

However, the bug is exploitable only if you have configured cache_peer to receive CONNECT requests.

ID	Name	Product	Family	Severity
198537	RHEL 5 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198536	RHEL 7 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198515	RHEL 6 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
93294	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:2089-1)	Nessus	SuSE Local Security Checks	high
93279	SUSE SLES12 Security Update : squid (SUSE-SU-2016:2008-1)	Nessus	SuSE Local Security Checks	high
93271	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)	Nessus	SuSE Local Security Checks	high
92994	openSUSE Security Update : squid (openSUSE-2016-988)	Nessus	SuSE Local Security Checks	high
90960	Fedora 22 : libecap-1.0.0-1.fc22 / squid-3.5.10-1.fc22 (2016-7b40eb9e29)	Nessus	Fedora Local Security Checks	medium
8951	Squid 3.x < 3.5.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
85184	Debian DSA-3327-1 : squid3 - security update	Nessus	Debian Local Security Checks	medium
85128	Debian DLA-286-1 : squid3 security update	Nessus	Debian Local Security Checks	medium
84553	FreeBSD : squid -- Improper Protection of Alternate Path with CONNECT requests (150d1538-23fa-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-5400

critical

Tenable Plugins

high

critical

critical

high

high

high

high

medium

high

medium

medium

medium