client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.

According to its banner, the version of Squid running on the remote host is 3.x after 3.2.0.11 and prior to 3.5.18, or 4.x prior to 4.0.10. It is, therefore, affected by a cache poisoning vulnerability in the handling of HTTP requests.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow flaw was found in the way the Squid     cachemgr.cgi utility processed remotely relayed Squid     input. When the CGI interface utility is used, a remote     attacker could possibly use this flaw to execute     arbitrary code. (CVE-2016-4051)

  - Buffer overflow and input validation flaws were found     in the way Squid processed ESI responses. If Squid was     used as a reverse proxy, or for TLS/HTTPS interception,     a remote attacker able to control ESI components on an     HTTP server could use these flaws to crash Squid,     disclose parts of the stack memory, or possibly execute     arbitrary code as the user running Squid.
    (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054)

  - An input validation flaw was found in the way Squid     handled intercepted HTTP Request messages. An attacker     could use this flaw to bypass the protection against     issues related to CVE-2009-0801, and perform cache     poisoning attacks on Squid. (CVE-2016-4553)

  - An input validation flaw was found in Squid's     mime_get_header_field() function, which is used to     search for headers within HTTP requests. An attacker     could send an HTTP request from the client side with     specially crafted header Host header that bypasses     same-origin security protections, causing Squid     operating as interception or reverse-proxy to contact     the wrong origin server. It could also be used for     cache poisoning for client not following RFC 7230.
    (CVE-2016-4554)

  - A NULL pointer dereference flaw was found in the way     Squid processes ESI responses. If Squid was used as a     reverse proxy or for TLS/HTTPS interception, a     malicious server could use this flaw to crash the Squid     worker process. (CVE-2016-4555)

  - An incorrect reference counting flaw was found in the     way Squid processes ESI responses. If Squid is     configured as reverse-proxy, for TLS/HTTPS     interception, an attacker controlling a server accessed     by Squid, could crash the squid worker, causing a     Denial of Service attack. (CVE-2016-4556)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Squid 3.5.x prior to 3.5.18 are affected by multiple vulnerabilities :

 - A flaw is triggered as input is not properly validated when handling HTTP request messages. This may allow a remote attacker to conduct a cache poisoning attack.
 - A flaw is triggered as input is not properly sanitized when handling specially crafted host headers. This may allow a remote attacker to bypass same-origin protection mechanisms and cause the program to contact the wrong origin server. This may also poison downstream caches.
 - Flaws in pointer handling and reference counting are triggered when handling specially crafted ESI response syntax. This may allow a remote server to cause a denial of service for Squid clients. 

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - Regression caused by the DoS fixes above (bsc#993299)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues :

  - Fixed multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2015-5400: Improper protection of alternate path.
    (bsc#938715)

  - CVE-2015-3455: Squid http proxy configured with     client-first SSL bumping did not correctly validate     server certificate. (bsc#929493)

  - CVE-2016-3948: Fixed denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: Fixed     multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4553: Fixed cache poisoning issue in HTTP     Request handling (bsc#979009)

  - CVE-2016-4554: Fixed header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fixed multiple Denial of Service issues in ESI Response     processing. (CVE-2016-4555, CVE-2016-4556, bsc#979011,     bsc#979008)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues :

  - Fixed multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2015-5400: Improper protection of alternate path.
    (bsc#938715)

  - CVE-2015-3455: Squid http proxy configured with     client-first SSL bumping did not correctly validate     server certificate. (bsc#929493)

  - CVE-2016-3948: Fixed denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: Fixed     multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4553: Fixed cache poisoning issue in HTTP     Request handling (bsc#979009)

  - CVE-2016-4554: Fixed header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fixed multiple Denial of Service issues in ESI Response     processing. (CVE-2016-4555, CVE-2016-4556, bsc#979011,     bsc#979008)

Additionally, the following non-security issues have been fixed :

  - Fix header size in script unsquid.pl. (bsc#902197)

  - Add external helper ext_session_acl to package.
    (bsc#959290)

  - Update forward_max_tries to permit 25 server paths With     cloud sites becoming more popular more CDN servers are     producing long lists of IPv6 and IPv4 addresses. If     there are not enough paths selected the IPv4 ones may     never be reached.

  - squid.init: wait that squid really dies when we kill it     on upgrade instead of proclaiming its demise prematurely     (bnc#963539)

This update was imported from the SUSE:SLE-12:Update update project.

Several security issues have been discovered in the Squid caching proxy.

  - CVE-2016-4051 :
    CESG and Yuriy M. Kaminskiy discovered that Squid     cachemgr.cgi was vulnerable to a buffer overflow when     processing remotely supplied inputs relayed through     Squid.

  - CVE-2016-4052 :
    CESG discovered that a buffer overflow made Squid     vulnerable to a Denial of Service (DoS) attack when     processing ESI responses.

  - CVE-2016-4053 :
    CESG found that Squid was vulnerable to public     information disclosure of the server stack layout when     processing ESI responses.

  - CVE-2016-4054 :
    CESG discovered that Squid was vulnerable to remote code     execution when processing ESI responses.

  - CVE-2016-4554 :
    Jianjun Chen found that Squid was vulnerable to a header     smuggling attack that could lead to cache poisoning and     to bypass of same-origin security policy in Squid and     some client browsers.

  - CVE-2016-4555, CVE-2016-4556 :
    'bfek-18' and '@vftable' found that Squid was vulnerable     to a Denial of Service (DoS) attack when processing ESI     responses, due to incorrect pointer handling and     reference counting.

Security fix for CVE-2016-4553, CVE-2016-4554, CVE-2016-4555, CVE-2016-4556

----

Security fix for CVE-2016-4051, CVE-2016-4052, CVE-2016-4053, CVE-2016-4054

----

Security fix for CVE-2016-3947 and CVE-2016-3948

----

Security fix for CVE-2016-2569 CVE-2016-2570 CVE-2016-2571 CVE-2016-2572

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bugfix

----

Security fix for CVE-2016-4553, CVE-2016-4554, CVE-2016-4555, CVE-2016-4556

----

Security fix for CVE-2016-4051, CVE-2016-4052, CVE-2016-4053, CVE-2016-4054

----

Security fix for CVE-2016-3947 and CVE-2016-3948

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201607-01 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

Security Fix(es) :

  - A buffer overflow flaw was found in the way the Squid     cachemgr.cgi utility processed remotely relayed Squid     input. When the CGI interface utility is used, a remote     attacker could possibly use this flaw to execute     arbitrary code. (CVE-2016-4051)

  - Buffer overflow and input validation flaws were found in     the way Squid processed ESI responses. If Squid was used     as a reverse proxy, or for TLS/HTTPS interception, a     remote attacker able to control ESI components on an     HTTP server could use these flaws to crash Squid,     disclose parts of the stack memory, or possibly execute     arbitrary code as the user running Squid.
    (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054)

  - An input validation flaw was found in the way Squid     handled intercepted HTTP Request messages. An attacker     could use this flaw to bypass the protection against     issues related to CVE-2009-0801, and perform cache     poisoning attacks on Squid. (CVE-2016-4553)

  - An input validation flaw was found in Squid's     mime_get_header_field() function, which is used to     search for headers within HTTP requests. An attacker     could send an HTTP request from the client side with     specially crafted header Host header that bypasses     same-origin security protections, causing Squid     operating as interception or reverse-proxy to contact     the wrong origin server. It could also be used for cache     poisoning for client not following RFC 7230.
    (CVE-2016-4554)

  - A NULL pointer dereference flaw was found in the way     Squid processes ESI responses. If Squid was used as a     reverse proxy or for TLS/HTTPS interception, a malicious     server could use this flaw to crash the Squid worker     process. (CVE-2016-4555)

  - An incorrect reference counting flaw was found in the     way Squid processes ESI responses. If Squid is     configured as reverse-proxy, for TLS/HTTPS interception,     an attacker controlling a server accessed by Squid,     could crash the squid worker, causing a Denial of     Service attack. (CVE-2016-4556)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2995-1 advisory.

    Yuriy M. Kaminskiy discovered that the Squid pinger utility incorrectly handled certain ICMPv6 packets. A     remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or     possibly cause Squid to leak information into log files. (CVE-2016-3947)

    Yuriy M. Kaminskiy discovered that the Squid cachemgr.cgi tool incorrectly handled certain crafted data. A     remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2016-4051)

    It was discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A remote     attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054)

    Jianjun Chen discovered that Squid did not correctly ignore the Host header when absolute-URI is provided.
    A remote attacker could possibly use this issue to conduct cache-poisoning attacks. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-4553)

    Jianjun Chen discovered that Squid incorrectly handled certain HTTP Host headers. A remote attacker could     possibly use this issue to conduct cache-poisoning attacks. (CVE-2016-4554)

    It was discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A remote     attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service.
    (CVE-2016-4555, CVE-2016-4556)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2016-1140 advisory.

    - Resolves: #1334499 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556       squid34: various flaws
    - Resolves: #1334506 - CVE-2016-4553 squid34: squid: Cache poisoning       issue in HTTP Request handling
    - Related: #1330574 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054       squid34: various flaws

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1139 advisory.

    - Related: #1330576 - CVE-2016-4553 squid: Cache poisoning issue in       HTTP Request handling
    - Related: #1334491 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556       squid: various flaws
    - Related: #1330576 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054       squid: various flaws

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for squid34 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The 'squid34' packages provide version 3.4 of Squid, a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Note that apart from 'squid34', this version of Red Hat Enterprise Linux also includes the 'squid' packages which provide Squid version 3.1.

Security Fix(es) :

* A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code. (CVE-2016-4051)

* Buffer overflow and input validation flaws were found in the way Squid processed ESI responses. If Squid was used as a reverse proxy, or for TLS/ HTTPS interception, a remote attacker able to control ESI components on an HTTP server could use these flaws to crash Squid, disclose parts of the stack memory, or possibly execute arbitrary code as the user running Squid. (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054)

* An input validation flaw was found in the way Squid handled intercepted HTTP Request messages. An attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform cache poisoning attacks on Squid. (CVE-2016-4553)

* An input validation flaw was found in Squid's mime_get_header_field() function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid operating as interception or reverse-proxy to contact the wrong origin server. It could also be used for cache poisoning for client not following RFC 7230. (CVE-2016-4554)

* A NULL pointer dereference flaw was found in the way Squid processes ESI responses. If Squid was used as a reverse proxy or for TLS/HTTPS interception, a malicious server could use this flaw to crash the Squid worker process. (CVE-2016-4555)

* An incorrect reference counting flaw was found in the way Squid processes ESI responses. If Squid is configured as reverse-proxy, for TLS/HTTPS interception, an attacker controlling a server accessed by Squid, could crash the squid worker, causing a Denial of Service attack. (CVE-2016-4556)

An update for squid is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es) :

* A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code. (CVE-2016-4051)

* Buffer overflow and input validation flaws were found in the way Squid processed ESI responses. If Squid was used as a reverse proxy, or for TLS/ HTTPS interception, a remote attacker able to control ESI components on an HTTP server could use these flaws to crash Squid, disclose parts of the stack memory, or possibly execute arbitrary code as the user running Squid. (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054)

* An input validation flaw was found in the way Squid handled intercepted HTTP Request messages. An attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform cache poisoning attacks on Squid. (CVE-2016-4553)

* An input validation flaw was found in Squid's mime_get_header_field() function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid operating as interception or reverse-proxy to contact the wrong origin server. It could also be used for cache poisoning for client not following RFC 7230. (CVE-2016-4554)

* A NULL pointer dereference flaw was found in the way Squid processes ESI responses. If Squid was used as a reverse proxy or for TLS/HTTPS interception, a malicious server could use this flaw to crash the Squid worker process. (CVE-2016-4555)

* An incorrect reference counting flaw was found in the way Squid processes ESI responses. If Squid is configured as reverse-proxy, for TLS/HTTPS interception, an attacker controlling a server accessed by Squid, could crash the squid worker, causing a Denial of Service attack. (CVE-2016-4556)

The squid development team reports :

Please reference CVE/URL list for details

ID	Name	Product	Family	Severity
119722	Squid 3.2.0.11 < 3.x < 3.5.18 / 4.x < 4.0.10 Cache Poisoning Vulnerability (SQUID-2016:7)	Nessus	Firewalls	high
99788	EulerOS 2.0 SP1 : squid (EulerOS-SA-2016-1025)	Nessus	Huawei Local Security Checks	high
9776	Squid 3.5.x < 3.5.18 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
93294	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:2089-1)	Nessus	SuSE Local Security Checks	high
93279	SUSE SLES12 Security Update : squid (SUSE-SU-2016:2008-1)	Nessus	SuSE Local Security Checks	high
93271	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)	Nessus	SuSE Local Security Checks	high
92994	openSUSE Security Update : squid (openSUSE-2016-988)	Nessus	SuSE Local Security Checks	high
92525	Debian DSA-3625-1 : squid3 - security update	Nessus	Debian Local Security Checks	high
92285	Fedora 23 : 7:squid (2016-b3b9407940)	Nessus	Fedora Local Security Checks	high
92268	Fedora 24 : 7:squid (2016-95edf19d8a)	Nessus	Fedora Local Security Checks	high
91982	GLSA-201607-01 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
91645	Scientific Linux Security Update : squid34 on SL6.x i386/x86_64 (20160531)	Nessus	Scientific Linux Local Security Checks	high
91558	Ubuntu 14.04 LTS / 16.04 LTS : Squid vulnerabilities (USN-2995-1)	Nessus	Ubuntu Local Security Checks	high
91513	Scientific Linux Security Update : squid on SL7.x x86_64 (20160531)	Nessus	Scientific Linux Local Security Checks	high
91417	Oracle Linux 6 : squid34 (ELSA-2016-1140)	Nessus	Oracle Linux Local Security Checks	high
91416	Oracle Linux 7 : squid (ELSA-2016-1139)	Nessus	Oracle Linux Local Security Checks	high
91393	CentOS 6 : squid34 (CESA-2016:1140)	Nessus	CentOS Local Security Checks	high
91392	CentOS 7 : squid (CESA-2016:1139)	Nessus	CentOS Local Security Checks	high
91383	RHEL 6 : squid34 (RHSA-2016:1140)	Nessus	Red Hat Local Security Checks	high
91382	RHEL 7 : squid (RHSA-2016:1139)	Nessus	Red Hat Local Security Checks	high
90980	FreeBSD : squid -- multiple vulnerabilities (25e5205b-1447-11e6-9ead-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-4553

high

Tenable Plugins

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high