Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: Heap overflow issue in URN processing (CVE-2019-12526)

  - Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is     configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary     code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow. (CVE-2014-6270)

  - Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote     authenticated users to retain access by leveraging a stale nonce, aka Nonce replay vulnerability.
    (CVE-2014-9749)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code     execution (CVE-2020-11945)

  - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2310 advisory.

  - Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for     certificate errors. (CVE-2018-19131)

  - Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.
    (CVE-2018-19132)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Squid before 4.13 and 5.x     before 5.0.4. Due to incorrect data validation, HTTP     Request Splitting attacks may succeed against HTTP and     HTTPS traffic. This leads to cache poisoning. This     allows any client, including browser scripts, to bypass     local security and poison the browser cache and any     downstream caches with content from an arbitrary     source. Squid uses a string search instead of parsing     the Transfer-Encoding header to find chunked encoding.
    This allows an attacker to hide a second request inside     Transfer-Encoding: it is interpreted by Squid as     chunked and split out into a second request delivered     upstream. Squid will then deliver two distinct     responses to the client, corrupting any downstream     caches.(CVE-2020-15811)

  - Squid before 4.4, when SNMP is enabled, allows a denial     of service (Memory Leak) via an SNMP     packet.(CVE-2018-19132)

  - Squid before 4.4 has XSS via a crafted X.509     certificate during HTTP(S) error page generation for     certificate errors.(CVE-2018-19131)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Squid before 4.4 has XSS via a crafted X.509     certificate during HTTP(S) error page generation for     certificate errors.(CVE-2018-19131)

  - Squid before 4.4, when SNMP is enabled, allows a denial     of service (Memory Leak) via an SNMP     packet.(CVE-2018-19132)

  - Incorrect HTTP Request header comparison in Squid HTTP     Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16     results in Collapsed Forwarding feature mistakenly     identifying some private responses as being suitable     for delivery to multiple clients.(CVE-2016-10003)

  - An issue was discovered in Squid 3.3.9 through 3.5.28     and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header     Proxy-Authorization. It searches for certain tokens     such as domain, uri, and qop. Squid checks if this     token's value starts with a quote and ends with one. If     so, it performs a memcpy of its length minus 2. Squid     never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a     memcpy of its length minus 1.(CVE-2019-12525)

  - The cachemgr.cgi web module of Squid through 4.7 has     XSS via the user_name or auth     parameter.(CVE-2019-13345)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Incorrect HTTP Request header comparison in Squid HTTP     Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16     results in Collapsed Forwarding feature mistakenly     identifying some private responses as being suitable     for delivery to multiple clients.(CVE-2016-10003)

  - Squid before 4.4 has XSS via a crafted X.509     certificate during HTTP(S) error page generation for     certificate errors.(CVE-2018-19131)

  - Squid before 4.4, when SNMP is enabled, allows a denial     of service (Memory Leak) via an SNMP     packet.(CVE-2018-19132)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid fixes the following issues :

Security issues fixed :

  - CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability     in the TLS error handling (bsc#1113668).

  - CVE-2018-19132: Fixed small memory leak in processing of     SNMP packets (bsc#1113669).

Non-security issues fixed :

  - Create runtime directories needed when SMP mode is     enabled (bsc#1112695, bsc#1112066).

  - Install license correctly (bsc#1082318).

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A Cross-Site Scripting vulnerability has been     discovered in squid in the way X.509 certificates     fields are displayed in some error pages. An attacker     who can control the certificate of the origin content     server may use this flaw to inject scripting code in     the squid generated page, which is executed on the     client's browser.(CVE-2018-19131)

  - A memory leak was discovered in the way Squid handles     SNMP denied queries. A remote attacker may use this     flaw to exhaust the resources on the server     machine.(CVE-2018-19132)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Version update + Security fix for CVE-2018-19131 and CVE-2018-19132

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid fixes the following issues :

Security issues fixed :

CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling (bsc#1113668).

CVE-2018-19132: Fixed small memory leak in processing of SNMP packets (bsc#1113669).

Non-security issues fixed: Create runtime directories needed when SMP mode is enabled (bsc#1112695, bsc#1112066).

Install license correctly (bsc#1082318).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Squid running on the remote host is 3.1.x after or equal to 3.1.12.1 and prior or equal to 3.1.23, 3.2.x after or equal to 3.2.0.4, 3.3.x, 3.4.x, 3.5.x prior or equal to 3.5.28, or 4.x prior to 4.4. It is, therefore, affected by a cross-site scripting (XSS) vulnerability due to improper validation of user-supplied input before returning it to users. A remote attacker controlled server can exploit this, by triggering error page delivery to a client with injected arbitrary script code that will execute in the client's browser session.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for squid fixes the following issues :

Security issues fixed :

  - CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability     in the TLS error handling (bsc#1113668).

  - CVE-2018-19132: Fixed small memory leak in processing of     SNMP packets (bsc#1113669).

Non-security issues fixed :

  - Create runtime directories needed when SMP mode is     enabled (bsc#1112695, bsc#1112066).

  - Install license correctly (bsc#1082318).

This update for squid3 fixes the following issues :

Security issue fixed :

CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling (bsc#1113668).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198536	RHEL 7 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198515	RHEL 6 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195586	RHEL 7 : squid (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
183476	Amazon Linux 2 : squid (ALAS-2023-2310)	Nessus	Amazon Linux Local Security Checks	medium
142152	EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-2323)	Nessus	Huawei Local Security Checks	medium
131599	EulerOS 2.0 SP2 : squid (EulerOS-SA-2019-2445)	Nessus	Huawei Local Security Checks	critical
130693	EulerOS 2.0 SP5 : squid (EulerOS-SA-2019-2231)	Nessus	Huawei Local Security Checks	high
123382	openSUSE Security Update : squid (openSUSE-2019-936)	Nessus	SuSE Local Security Checks	medium
122217	EulerOS 2.0 SP3 : squid (EulerOS-SA-2019-1044)	Nessus	Huawei Local Security Checks	medium
120523	Fedora 29 : 7:squid (2018-714298460e)	Nessus	Fedora Local Security Checks	medium
120164	SUSE SLES15 Security Update : squid (SUSE-SU-2018:3786-1)	Nessus	SuSE Local Security Checks	medium
119726	Squid 3.1.12.1 <= 3.1.x <= 3.1.23 / 3.2.0.4 <= 3.2.x / 3.3.x / 3.4.x / 3.5.x <= 3.5.28 / 4.x < 4.4 Cross-Site Scripting Vulnerability (SQUID-2018:4)	Nessus	Firewalls	medium
119554	SUSE SLES12 Security Update : squid (SUSE-SU-2018:3771-2)	Nessus	SuSE Local Security Checks	medium
119079	openSUSE Security Update : squid (openSUSE-2018-1429)	Nessus	SuSE Local Security Checks	medium
119078	openSUSE Security Update : squid (openSUSE-2018-1428)	Nessus	SuSE Local Security Checks	medium
119035	SUSE SLES11 Security Update : squid3 (SUSE-SU-2018:3790-1)	Nessus	SuSE Local Security Checks	medium
119012	SUSE SLES12 Security Update : squid (SUSE-SU-2018:3771-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-19131

medium

Tenable Plugins

critical

critical

high

medium

medium

critical

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium