Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code     execution (CVE-2020-11945)

  - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to its banner, the version of Squid running on the remote host is 3.x after 3.1 and prior to 3.5.23, or 4.x prior to 4.0.17. It is, therefore, affected by an information disclosure vulnerability in the HTTP request processing component due to the incorrect HTTP conditional request handling. An unauthenticated, remote attacker can exploit this to disclose potentially sensitive information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for squid34 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The squid34 packages provide version 3.4 of Squid, a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es) :

* It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached request. A remote attacker could send a specially crafted request to an HTTP server via the squid proxy and steal private data from other connections. (CVE-2016-10002)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for squid is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es) :

* It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached request. A remote attacker could send a specially crafted request to an HTTP server via the squid proxy and steal private data from other connections. (CVE-2016-10002)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that squid did not properly remove     connection specific headers when answering conditional     requests using a cached request. A remote attacker     could send a specially crafted request to an HTTP     server via the squid proxy and steal private data from     other connections. (CVE-2016-10002)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3192-1 advisory.

    Saulius Lapinskas discovered that Squid incorrectly handled processing HTTP conditional requests. A remote     attacker could possibly use this issue to obtain sensitive information related to other clients' browsing     sessions. (CVE-2016-10002)

    Felix Hassert discovered that Squid incorrectly handled certain HTTP Request headers when using the     Collapsed Forwarding feature. A remote attacker could possibly use this issue to obtain sensitive     information related to other clients' browsing sessions. This issue only applied to Ubuntu 16.04 LTS and     Ubuntu 16.10. (CVE-2016-10003)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for squid34 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The squid34 packages provide version 3.4 of Squid, a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es) :

* It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached request. A remote attacker could send a specially crafted request to an HTTP server via the squid proxy and steal private data from other connections. (CVE-2016-10002)

An update for squid is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es) :

* It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached request. A remote attacker could send a specially crafted request to an HTTP server via the squid proxy and steal private data from other connections. (CVE-2016-10002)

Security Fix(es) :

  - It was found that squid did not properly remove     connection specific headers when answering conditional     requests using a cached request. A remote attacker could     send a specially crafted request to an HTTP server via     the squid proxy and steal private data from other     connections. (CVE-2016-10002)

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2017-0183 advisory.

    [7:3.4.14-9.4]
    - Resolves: #1412733 - CVE-2016-10002 squid34: squid: Information disclosure       in HTTP request processing

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0182 advisory.

    [7:3.5.20-2.2]
    - Resolves: #1412735 - CVE-2016-10002 squid: Information disclosure in HTTP       request processing

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2016-10002, CVE-2016-10003

----

Version update and bugfix of #1392476

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid fixes the following issues :

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168)

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942)

This update was imported from the SUSE:SLE-12:Update update project.

This update for squid fixes the following issues :

  - CVE-2016-10003: Prevent incorrect forwarding of cached     private responses when Collapsed Forwarding feature is     enabled. This allowed remote attacker (proxy user) to     discover private and sensitive information about another     user (bsc#1016169).

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168).

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for squid fixes the following issues :

  - CVE-2016-10003: Prevent incorrect forwarding of cached     private responses when Collapsed Forwarding feature is     enabled. This allowed remote attacker (proxy user) to     discover private and sensitive information about another     user (bsc#1016169).

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168).

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid fixes the following issues :

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168)

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168)

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Squid 4.0.x prior to 4.0.17, and 3.5.x prior to 3.5.18 are affected by multiple vulnerabilities :

 - A flaw exists in the collapsed forwarding functionality in 'client_side_reply.cc' that is triggered as request headers are not properly compared, which can cause the program to deliver responses containing private data to clients it should not have reached.  This may allow a remote attacker to gain access to potentially sensitive information from other sessions.
 - A flaw exists in 'client_side_reply.cc' that is triggered during the handling of HTTP conditional requests.  This may allow a remote attacker to gain access to potentially sensitive information from other sessions. 

Squid security advisory 2016:10 reports :

Due to incorrect comparison of request headers Squid can deliver responses containing private data to clients it should not have reached.

This problem allows a remote attacker to discover private and sensitive information about another clients browsing session.
Potentially including credentials which allow access to further sensitive resources. This problem only affects Squid configured to use the Collapsed Forwarding feature. It is of particular importance for HTTPS reverse-proxy sites with Collapsed Forwarding.

Squid security advisory 2016:11 reports :

Due to incorrect HTTP conditional request handling Squid can deliver responses containing private data to clients it should not have reached.

This problem allows a remote attacker to discover private and sensitive information about another clients browsing session.
Potentially including credentials which allow access to further sensitive resources..

Saulius Lapinskas from Lithuanian State Social Insurance Fund Board discovered that Squid3, a fully featured web proxy cache, does not properly process responses to If-None-Modified HTTP conditional requests, leading to client-specific Cookie data being leaked to other clients. A remote attacker can take advantage of this flaw to discover private and sensitive information about another clients browsing session.

Saulius Lapinskas from Lithuanian State Social Insurance Fund Board discovered that Squid3, a fully featured web proxy cache, does not properly process responses to If-None-Modified HTTP conditional requests, leading to client-specific Cookie data being leaked to other clients. A remote attacker can take advantage of this flaw to discover private and sensitive information about another client's browsing session.

For Debian 7 'Wheezy', these problems have been fixed in version 3.1.20-2.2+deb7u7.

We recommend that you upgrade your squid3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198515	RHEL 6 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
119721	Squid 3.1 < 3.x < 3.5.23 / 4.x < 4.0.17 Information Disclosure Vulnerability (SQUID-2016:11)	Nessus	Firewalls	high
101414	Virtuozzo 6 : squid34 (VZLSA-2017-0183)	Nessus	Virtuozzo Local Security Checks	high
101413	Virtuozzo 7 : squid / squid-migration-script / squid-sysvinit (VZLSA-2017-0182)	Nessus	Virtuozzo Local Security Checks	high
99864	EulerOS 2.0 SP2 : squid (EulerOS-SA-2017-1018)	Nessus	Huawei Local Security Checks	high
99863	EulerOS 2.0 SP1 : squid (EulerOS-SA-2017-1017)	Nessus	Huawei Local Security Checks	high
97049	Ubuntu 14.04 LTS / 16.04 LTS : Squid vulnerabilities (USN-3192-1)	Nessus	Ubuntu Local Security Checks	high
96811	CentOS 6 : squid34 (CESA-2017:0183)	Nessus	CentOS Local Security Checks	high
96810	CentOS 7 : squid (CESA-2017:0182)	Nessus	CentOS Local Security Checks	high
96760	Scientific Linux Security Update : squid on SL7.x x86_64 (20170124)	Nessus	Scientific Linux Local Security Checks	high
96759	Scientific Linux Security Update : squid34 on SL6.x i386/x86_64 (20170124)	Nessus	Scientific Linux Local Security Checks	high
96755	RHEL 6 : squid34 (RHSA-2017:0183)	Nessus	Red Hat Local Security Checks	high
96754	RHEL 7 : squid (RHSA-2017:0182)	Nessus	Red Hat Local Security Checks	high
96752	Oracle Linux 6 : squid34 (ELSA-2017-0183)	Nessus	Oracle Linux Local Security Checks	high
96751	Oracle Linux 7 : squid (ELSA-2017-0182)	Nessus	Oracle Linux Local Security Checks	high
96670	Fedora 25 : 7:squid (2016-c614315d29)	Nessus	Fedora Local Security Checks	high
96648	openSUSE Security Update : squid (openSUSE-2017-127)	Nessus	SuSE Local Security Checks	high
96622	openSUSE Security Update : squid (openSUSE-2017-115)	Nessus	SuSE Local Security Checks	high
96530	SUSE SLES12 Security Update : squid (SUSE-SU-2017:0128-1)	Nessus	SuSE Local Security Checks	high
96482	SUSE SLES12 Security Update : squid (SUSE-SU-2017:0116-1)	Nessus	SuSE Local Security Checks	high
96432	SUSE SLES11 Security Update : squid3 (SUSE-SU-2017:0110-1)	Nessus	SuSE Local Security Checks	high
9858	Squid 3.5.x < 3.5.23 / 4.0.x < 4.0.17 Multiple Information Disclosure	Nessus Network Monitor	Web Servers	low
96117	FreeBSD : squid -- multiple vulnerabilities (41f8af15-c8b9-11e6-ae1b-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
96102	Debian DSA-3745-1 : squid3 - security update	Nessus	Debian Local Security Checks	high
96098	Debian DLA-763-1 : squid3 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-10002

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

low

high

high

high