The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code     execution (CVE-2020-11945)

  - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1068 advisory.

    - Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter       in cachemgr.cgi
    - Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has squid packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid     calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's     being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a     new member to the stack. When adding a new member, there is no check to ensure that the stack won't     overflow. (CVE-2019-12519)

  - An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest     Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the     attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if     the pooled token credentials are freed (instead of replayed as valid credentials). (CVE-2020-11945)

  - The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a     Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service     for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP     response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed     in 4.0.23 and later. (CVE-2018-1000024)

  - The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL     Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in     Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server     responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to     have been fixed in 4.0.23 and later. (CVE-2018-1000027)

  - An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as     domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it     performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a memcpy of its length minus 1. (CVE-2019-12525)

  - The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
    (CVE-2019-13345)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has squid packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid     calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's     being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a     new member to the stack. When adding a new member, there is no check to ensure that the stack won't     overflow. (CVE-2019-12519)

  - An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest     Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the     attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if     the pooled token credentials are freed (instead of replayed as valid credentials). (CVE-2020-11945)

  - The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a     Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service     for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP     response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed     in 4.0.23 and later. (CVE-2018-1000024)

  - The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL     Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in     Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server     responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to     have been fixed in 4.0.23 and later. (CVE-2018-1000027)

  - An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as     domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it     performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a memcpy of its length minus 1. (CVE-2019-12525)

  - The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
    (CVE-2019-13345)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

* squid: Incorrect pointer handling when processing ESI Responses can lead to denial of service * squid: Incorrect pointer handling in HTTP processing and certificate download can lead to denial of service

* squid: XSS via user_name or auth parameter in cachemgr.cgi

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1068 advisory.

  - The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a     Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service     for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP     response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed     in 4.0.23 and later. (CVE-2018-1000024)

  - The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL     Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in     Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server     responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to     have been fixed in 4.0.23 and later. (CVE-2018-1000027)

  - The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
    (CVE-2019-13345)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1068 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Incorrect pointer handling when processing ESI Responses can lead to denial of service     (CVE-2018-1000024)

    * squid: Incorrect pointer handling in HTTP processing and certificate download can lead to denial of     service (CVE-2018-1000027)

    * squid: XSS via user_name or auth parameter in cachemgr.cgi (CVE-2019-13345)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.5.28, or 4.x prior to 4.0.23. It is, therefore, affected by multiple vulnerabilities:

  - A denial of service (DoS) vulnerability exists in the ESI     response processing component due to incorrect pointer handling.
    A remote attacker controlled server can exploit this issue, via a     crafted ESI response, to cause a denial of service for all     clients accessing the Squid service (CVE-2018-1000024)

  - A denial of service (DoS) vulnerability exists in the HTTP     message processing component due to incorrect pointer handling.
    An unauthenticated remote attacker can exploit this issue, via a     crafted HTTP request, to cause a denial of service for all     clients accessing the Squid service (CVE-2018-1000027)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Squid Software Foundation Squid HTTP Caching Proxy contains a NULL pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request.(CVE-2018-1000027)

The Squid Software Foundation Squid HTTP Caching Proxy contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy..
This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.(CVE-2018-1000024)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The Squid Software Foundation Squid HTTP Caching Proxy     version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a     Incorrect Pointer Handling vulnerability in ESI     Response Processing that can result in Denial of     Service for all clients using the proxy.. This attack     appear to be exploitable via Remote server delivers an     HTTP response payload containing valid but unusual ESI     syntax..(CVE-2018-1000024)

  - The Squid Software Foundation Squid HTTP Caching Proxy     version prior to version 4.0.23 contains a NULL Pointer     Dereference vulnerability in HTTP Response     X-Forwarded-For header processing that can result in     Denial of Service to all clients of the proxy. This     attack appear to be exploitable via Remote HTTP server     responding with an X-Forwarded-For header to certain     types of HTTP request. (CVE-2018-1000027)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues: Security issues fixed :

  - CVE-2018-1000024: DoS fix caused by incorrect pointer     handling when processing ESI responses. This affects the     default custom esi_parser (bsc#1077003).

  - CVE-2018-1000027: DoS fix caused by incorrect pointer     handing whien processing ESI responses or downloading     intermediate CA certificates (bsc#1077006).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid fixes the following issues: Security issues fixed :

  - CVE-2018-1000024: DoS fix caused by incorrect pointer     handling when processing ESI responses. This affects the     default custom esi_parser (bsc#1077003).

  - CVE-2018-1000027: DoS fix caused by incorrect pointer     handing whien processing ESI responses or downloading     intermediate CA certificates (bsc#1077006).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid fixes the following issues :

Security issues fixed :

  - CVE-2018-1000024: DoS fix caused by incorrect pointer     handling when processing ESI responses. This affects the     default custom esi_parser (bsc#1077003).

  - CVE-2018-1000027: DoS fix caused by incorrect pointer     handing whien processing ESI responses or downloading     intermediate CA certificates (bsc#1077006).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

Louis Dion-Marcil reports :

Due to incorrect pointer handling Squid is vulnerable to denial of service attack when processing ESI responses.

This problem allows a remote server delivering certain ESI response syntax to trigger a denial of service for all clients accessing the Squid service.

Due to unrelated changes Squid-3.5 has become vulnerable to some regular ESI server responses also triggering this issue.

This problem is limited to the Squid custom ESI parser. Squid built to use libxml2 or libexpat XML parsers do not have this problem.

Due to incorrect pointer handling Squid is vulnerable to denial of service attack when processing ESI responses or downloading intermediate CA certificates.

This problem allows a remote client delivering certain HTTP requests in conjunction with certain trusted server responses to trigger a denial of service for all clients accessing the Squid service.

Several vulnerabilities have been discovered in Squid3, a fully featured web proxy cache. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2018-1000024     Louis Dion-Marcil discovered that Squid does not     properly handle processing of certain ESI responses. A     remote server delivering certain ESI response syntax can     take advantage of this flaw to cause a denial of service     for all clients accessing the Squid service. This     problem is limited to the Squid custom ESI parser.

  - CVE-2018-1000027     Louis Dion-Marcil discovered that Squid is prone to a     denial of service vulnerability when processing ESI     responses or downloading intermediate CA certificates. A     remote attacker can take advantage of this flaw to cause     a denial of service for all clients accessing the Squid     service.

Bugfix + security update

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3557-1 advisory.

    Mathias Fischer discovered that Squid incorrectly handled certain long strings in headers. A malicious     remote server could possibly cause Squid to crash, resulting in a denial of service. This issue was only     addressed in Ubuntu 16.04 LTS. (CVE-2016-2569)

    William Lima discovered that Squid incorrectly handled XML parsing when processing Edge Side Includes     (ESI). A malicious remote server could possibly cause Squid to crash, resulting in a denial of service.
    This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2016-2570)

    Alex Rousskov discovered that Squid incorrectly handled response-parsing failures. A malicious remote     server could possibly cause Squid to crash, resulting in a denial of service. This issue only applied to     Ubuntu 16.04 LTS. (CVE-2016-2571)

    Santiago Ruano Rincn discovered that Squid incorrectly handled certain Vary headers. A remote attacker     could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue was     only addressed in Ubuntu 16.04 LTS. (CVE-2016-3948)

    Louis Dion-Marcil discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A     malicious remote server could possibly cause Squid to crash, resulting in a denial of service.
    (CVE-2018-1000024)

    Louis Dion-Marcil discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A     malicious remote server could possibly cause Squid to crash, resulting in a denial of service.
    (CVE-2018-1000027)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Squid, a high-performance proxy caching server for web clients, has been found vulnerable to denial of service attacks associated with ESI response processing and intermediate CA certificate downloading.

CVE-2018-1000024

Incorrect pointer handling resulted in the ability of a remote server to return a crafted ESI response which could trigger a denial of service for all clients accessing the Squid service. This issue affects the Squid custom ESI parser. 

CVE-2018-1000027

Incorrect pointer handling resulted in the possibility of a remote client delivering certain HTTP requests in conjunction with certain trusted server reponses involving the processing of ESI responses or downloading of intermediate CA certificates to trigger a denial of service for all clients accessing the squid service.

For Debian 7 'Wheezy', these problems have been fixed in version 3.1.20-2.2+deb7u8.

We recommend that you upgrade your squid3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198515	RHEL 6 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
180752	Oracle Linux 7 : squid (ELSA-2020-1068)	Nessus	Oracle Linux Local Security Checks	medium
143989	NewStart CGSL CORE 5.05 / MAIN 5.05 : squid Multiple Vulnerabilities (NS-SA-2020-0090)	Nessus	NewStart CGSL Local Security Checks	critical
143907	NewStart CGSL CORE 5.04 / MAIN 5.04 : squid Multiple Vulnerabilities (NS-SA-2020-0060)	Nessus	NewStart CGSL Local Security Checks	critical
135837	Scientific Linux Security Update : squid on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	medium
135330	CentOS 7 : squid (RHSA-2020:1068)	Nessus	CentOS Local Security Checks	medium
135061	RHEL 7 : squid (RHSA-2020:1068)	Nessus	Red Hat Local Security Checks	medium
119724	Squid 3.x < 3.5.28 / 4.x < 4.0.23 Multiple Denial of Service Vulnerabilities (SQUID-2018:1) (SQUID-2018:2)	Nessus	Firewalls	high
117605	Amazon Linux AMI : squid (ALAS-2018-1081)	Nessus	Amazon Linux Local Security Checks	high
109473	EulerOS 2.0 SP2 : squid (EulerOS-SA-2018-1075)	Nessus	Huawei Local Security Checks	high
109472	EulerOS 2.0 SP1 : squid (EulerOS-SA-2018-1074)	Nessus	Huawei Local Security Checks	high
108528	SUSE SLES11 Security Update : squid3 (SUSE-SU-2018:0752-1)	Nessus	SuSE Local Security Checks	high
107252	SUSE SLES12 Security Update : squid (SUSE-SU-2018:0636-1)	Nessus	SuSE Local Security Checks	high
107245	openSUSE Security Update : squid (openSUSE-2018-238)	Nessus	SuSE Local Security Checks	high
106995	FreeBSD : squid -- Vulnerable to Denial of Service attack (d5b6d151-1887-11e8-94f7-9c5c8e75236a)	Nessus	FreeBSD Local Security Checks	high
106957	Debian DSA-4122-1 : squid3 - security update	Nessus	Debian Local Security Checks	high
106635	Fedora 27 : 7:squid (2018-4fabf63492)	Nessus	Fedora Local Security Checks	high
106619	Ubuntu 14.04 LTS / 16.04 LTS : Squid vulnerabilities (USN-3557-1)	Nessus	Ubuntu Local Security Checks	high
106589	Debian DLA-1266-1 : squid3 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-1000024

high

Tenable Plugins

critical

medium

critical

critical

medium

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high