Debian dla-4083 : squid - security update

high Nessus Plugin ID 232586

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4083 advisory.

------------------------------------------------------------------------- Debian LTS Advisory DLA-4083-1 [email protected] https://www.debian.org/lts/security/ Jochen Sprickerhof March 11, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : squid Version : 4.13-10+deb11u4 CVE ID : CVE-2024-25111 CVE-2024-37894 CVE-2024-45802 Debian Bug :

Several security vulnerabilities have been discovered in Squid, a full featured web proxy cache.

CVE-2024-25111

A possible Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message.

CVE-2024-37894

Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

CVE-2024-45802

Disable ESI feature support.
- Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Denial of Service attacks by a trusted server against all clients using the proxy. This problem is fixed by changing the build configuration to specify the --disable-esi option.

For Debian 11 bullseye, these problems have been fixed in version 4.13-10+deb11u4.

We recommend that you upgrade your squid packages.

For the detailed security status of squid please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/squid

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
signature.asc Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the squid packages.

Plugin Details

Severity: High

ID: 232586

File Name: debian_DLA-4083.nasl

Version: 1.1

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 3/11/2025

Updated: 3/11/2025

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2024-45802

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:squid, p-cpe:/a:debian:debian_linux:squid-common, p-cpe:/a:debian:debian_linux:squid-cgi, p-cpe:/a:debian:debian_linux:squidclient, p-cpe:/a:debian:debian_linux:squid-purge, p-cpe:/a:debian:debian_linux:squid-openssl

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 3/11/2025

Vulnerability Publication Date: 3/6/2024

Reference Information

CVE: CVE-2024-25111, CVE-2024-37894, CVE-2024-45802

IAVB: 2024-B-0087-S, 2024-B-0168

Detections

Analytics