Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-4051.

Versions of Squid 3.5.x prior to 3.5.17 are affected by multiple vulnerabilities :

 - A flaw in 'esi/Esi.cc' is triggered as input is not properly validated when handling ESI responses. This may allow a remote attacker to disclose the server stack layout.
 - An overflow condition in 'esi/Esi.cc' is triggered as user-supplied input is not properly validated when handling ESI responses. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - An assertion flaw in 'esi/Esi.cc' is triggered as input is not properly validated when handling ESI responses. This may allow a remote attacker to terminate the service.
 - An overflow condition is triggered as user-supplied input is not properly validated when processing the length of content lines in reports by the 'cachemgr.cgi' tool. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.

A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code. (CVE-2016-4051)

It was found that the fix for CVE-2016-4051 did not properly prevent the stack overflow in the munge_other_line() function. A remote attacker could send specially crafted data to the Squid proxy, which would exploit the cachemgr CGI utility, possibly triggering execution of arbitrary code. (CVE-2016-5408)

Security Fix(es) :

  - It was found that the fix for CVE-2016-4051 released via     SLSA-2016:1138 did not properly prevent the stack     overflow in the munge_other_line() function. A remote     attacker could send specially crafted data to the Squid     proxy, which would exploit the cachemgr CGI utility,     possibly triggering execution of arbitrary code.
    (CVE-2016-5408)

An update for squid is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es) :

* It was found that the fix for CVE-2016-4051 released via RHSA-2016:1138 did not properly prevent the stack overflow in the munge_other_line() function. A remote attacker could send specially crafted data to the Squid proxy, which would exploit the cachemgr CGI utility, possibly triggering execution of arbitrary code.
(CVE-2016-5408)

Red Hat would like to thank Amos Jeffries (Squid) for reporting this issue.

From Red Hat Security Advisory 2016:1573 :

An update for squid is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es) :

* It was found that the fix for CVE-2016-4051 released via RHSA-2016:1138 did not properly prevent the stack overflow in the munge_other_line() function. A remote attacker could send specially crafted data to the Squid proxy, which would exploit the cachemgr CGI utility, possibly triggering execution of arbitrary code.
(CVE-2016-5408)

Red Hat would like to thank Amos Jeffries (Squid) for reporting this issue.

ID	Name	Product	Family	Severity
9775	Squid 3.5.x < 3.5.17 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
93013	Amazon Linux AMI : squid (ALAS-2016-735)	Nessus	Amazon Linux Local Security Checks	critical
92749	Scientific Linux Security Update : squid on SL6.x i386/x86_64 (20160804)	Nessus	Scientific Linux Local Security Checks	critical
92748	RHEL 6 : squid (RHSA-2016:1573)	Nessus	Red Hat Local Security Checks	critical
92747	Oracle Linux 6 : squid (ELSA-2016-1573)	Nessus	Oracle Linux Local Security Checks	critical
92726	CentOS 6 : squid (CESA-2016:1573)	Nessus	CentOS Local Security Checks	critical

Detections

Analytics

CVE-2016-5408

critical

Tenable Plugins

medium

critical

critical

critical

critical

critical