An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2019:2593 advisory.

  - An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with     HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the     decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled     data. (CVE-2019-12527)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of Squid installed on the remote host is prior to 4.8. It is, therefore, affected by multiple vulnerabilities:

 - A denial of service exists due to incorrect buffer management when processing HTTP Basic Authentication and HTTP Digest Authentication credentials. (CVE-2019-12525 / CVE-2019-12529)

 - An access control bypass, a cache poisoning and a Cross-Site Scripting (XSS) exist due to incorrect URL handling when processing HTTP Request messages. (CVE-2019-12520 / CVE-2019-12524)

 - A heap overflow and a possible remote code execution exist due to incorrect buffer management when processing HTTP Authentication credentials. (CVE-2019-12527)

 - Multiple Cross-Site Scripting (XSS) exist in cachemgr.cgi tool due to incorrect input handling. (CVE-2019-12854 / CVE-2019-13345) Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2593 advisory.

  - squid: heap-based buffer overflow in HttpHeader::getAuth (CVE-2019-12527)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for squid to version 4.9 fixes the following issues :

Security issues fixed :

  - CVE-2019-13345: Fixed multiple cross-site scripting     vulnerabilities in cachemgr.cgi (bsc#1140738).

  - CVE-2019-12526: Fixed potential remote code execution     during URN processing (bsc#1156326).

  - CVE-2019-12523,CVE-2019-18676: Fixed multiple improper     validations in URI processing (bsc#1156329).

  - CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP     Request processing (bsc#1156328).

  - CVE-2019-18678: Fixed incorrect message parsing which     could have led to HTTP request splitting issue     (bsc#1156323).

  - CVE-2019-18679: Fixed information disclosure when     processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed :

  - Fixed DNS failures when peer name was configured with     any upper case characters

  - Fixed several rock cache_dir corruption issues

This update was imported from the SUSE:SLE-15:Update update project.

This update for squid to version 4.9 fixes the following issues :

Security issues fixed :

CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).

CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).

CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).

CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).

CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).

CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed :

  - Fixed DNS failures when peer name was configured with     any upper case characters

  - Fixed several rock cache_dir corruption issues

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Squid 3.3.9 through 3.5.28     and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header     Proxy-Authorization. It searches for certain tokens     such as domain, uri, and qop. Squid checks if this     token's value starts with a quote and ends with one. If     so, it performs a memcpy of its length minus 2. Squid     never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a     memcpy of its length minus 1.(CVE-2019-12525)

  - The cachemgr.cgi web module of Squid through 4.7 has     XSS via the user_name or auth     parameter.(CVE-2019-13345)

  - An issue was discovered in Squid 4.0.23 through 4.7.
    When checking Basic Authentication with     HttpHeader::getAuth, Squid uses a global buffer to     store the decoded data. Squid does not check that the     decoded length isn't greater than the buffer, leading     to a heap-based buffer overflow with user controlled     data.(CVE-2019-12527)

  - An issue was discovered in Squid 2.x through     2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7.
    When Squid is configured to use Basic Authentication,     the Proxy-Authorization header is parsed via uudecode.
    uudecode determines how many bytes will be decoded by     iterating over the input and checking its table. The     length is then used to start decoding the string. There     are no checks to ensure that the length it calculates     isn't greater than the input buffer. This leads to     adjacent memory being decoded as well. An attacker     would not be able to retrieve the decoded data unless     the Squid maintainer had configured the display of     usernames on error pages.(CVE-2019-12529)

  - Due to incorrect string termination, Squid cachemgr.cgi     4.0 through 4.7 may access unallocated memory. On     systems with memory access protections, this can cause     the CGI process to terminate unexpectedly, resulting in     a denial of service for all clients using     it.(CVE-2019-12854)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2593 advisory.

    libecap     [1.0.1-2]
    - Resolves: #1696354 - Ensure modular RPM upgrade path

    squid     [7:4.4-5]
    - Resolves: #1744672 - CVE-2019-12527 squid:4/squid: heap-based buffer overflow       in HttpHeader::getAuth

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2593 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: heap-based buffer overflow in HttpHeader::getAuth (CVE-2019-12527)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in Squid, a fully featured web proxy cache. The flaws in the HTTP Digest Authentication processing, the HTTP Basic Authentication processing and in the cachemgr.cgi allowed remote attackers to perform denial of service and cross-site scripting attacks, and potentially the execution of arbitrary code.

Resolves: #1737030 - Depend on httpd-filesystem

----

Security fix for CVE-2019-12525 CVE-2019-12527 CVE-2019-12529 CVE-2019-12854 .

  - update to version 4.8

----

Security fix for CVE-2019-13345.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4065-1 advisory.

    It was discovered that Squid incorrectly handled Digest authentication. A remote attacker could possibly     use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2019-12525)

    It was discovered that Squid incorrectly handled Basic authentication. A remote attacker could use this     issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 19.04. (CVE-2019-12527)

    It was discovered that Squid incorrectly handled Basic authentication. A remote attacker could possibly     use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2019-12529)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185084	Rocky Linux 8 : squid:4 (RLSA-2019:2593)	Nessus	Rocky Linux Local Security Checks	high
112695	Squid < 4.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
145581	CentOS 8 : squid:4 (CESA-2019:2593)	Nessus	CentOS Local Security Checks	high
131220	openSUSE Security Update : squid (openSUSE-2019-2541)	Nessus	SuSE Local Security Checks	critical
131219	openSUSE Security Update : squid (openSUSE-2019-2540)	Nessus	SuSE Local Security Checks	critical
131070	SUSE SLES15 Security Update : squid (SUSE-SU-2019:2975-1)	Nessus	SuSE Local Security Checks	critical
129452	EulerOS 2.0 SP8 : squid (EulerOS-SA-2019-2093)	Nessus	Huawei Local Security Checks	critical
128512	Oracle Linux 8 : squid:4 (ELSA-2019-2593)	Nessus	Oracle Linux Local Security Checks	high
128452	RHEL 8 : squid:4 (RHSA-2019:2593)	Nessus	Red Hat Local Security Checks	high
128125	Debian DSA-4507-1 : squid - security update	Nessus	Debian Local Security Checks	critical
127874	Fedora 29 : 7:squid (2019-cb50bcc189)	Nessus	Fedora Local Security Checks	critical
126817	Ubuntu 16.04 LTS / 18.04 LTS : Squid vulnerabilities (USN-4065-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2019-12527

high

Tenable Plugins

high

critical

high

critical

critical

critical

critical

high

high

critical

critical

critical