Vulnerabilities > CVE-2013-4115 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
opensuse
squid-cache
CWE-119
nessus

Summary

Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to cause a denial of service (memory corruption and server termination) via a long name in a DNS lookup request.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2014-1148.NASL
    descriptionFrom Red Hat Security Advisory 2014:1148 : An updated squid package that fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609) A buffer overflow flaw was found in Squid
    last seen2020-06-01
    modified2020-06-02
    plugin id77517
    published2014-09-04
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/77517
    titleOracle Linux 5 / 6 : squid (ELSA-2014-1148)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2014:1148 and 
    # Oracle Linux Security Advisory ELSA-2014-1148 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(77517);
      script_version("1.9");
      script_cvs_date("Date: 2019/09/30 10:58:19");
    
      script_cve_id("CVE-2013-4115", "CVE-2014-3609");
      script_bugtraq_id(61111, 69453);
      script_xref(name:"RHSA", value:"2014:1148");
    
      script_name(english:"Oracle Linux 5 / 6 : squid (ELSA-2014-1148)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2014:1148 :
    
    An updated squid package that fixes two security issues is now
    available for Red Hat Enterprise Linux 5 and 6.
    
    Red Hat Product Security has rated this update as having Important
    security impact. Common Vulnerability Scoring System (CVSS) base
    scores, which give detailed severity ratings, are available for each
    vulnerability from the CVE links in the References section.
    
    Squid is a high-performance proxy caching server for web clients,
    supporting FTP, Gopher, and HTTP data objects.
    
    A flaw was found in the way Squid handled malformed HTTP Range
    headers. A remote attacker able to send HTTP requests to the Squid
    proxy could use this flaw to crash Squid. (CVE-2014-3609)
    
    A buffer overflow flaw was found in Squid's DNS lookup module. A
    remote attacker able to send HTTP requests to the Squid proxy could
    use this flaw to crash Squid. (CVE-2013-4115)
    
    Red Hat would like to thank the Squid project for reporting the
    CVE-2014-3609 issue. Upstream acknowledges Matthew Daley as the
    original reporter.
    
    All Squid users are advised to upgrade to this updated package, which
    contains backported patches to correct these issues. After installing
    this update, the squid service will be restarted automatically."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2014-September/004402.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2014-September/004405.html"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected squid package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:squid");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2013/08/09");
      script_set_attribute(attribute:"patch_publication_date", value:"2014/09/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/09/04");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(5|6)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 5 / 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL5", reference:"squid-2.6.STABLE21-7.el5_10")) flag++;
    
    if (rpm_check(release:"EL6", reference:"squid-3.1.10-22.el6_5")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "squid");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-700.NASL
    descriptionThis squid3 update includes several security fixes and minor changes. - squid-3.1.x-bnc829084-CVE-2013-4115-BO_request_handling. diff Squid advisory SQUID-2013_2, CVE-2013-4115, [bnc#829084] Specially crafted http requests can trigger a buffer overflow when squid attempts to resolve an overly long hostname. - run logrotate as squid:nogroup [bnc#677335]
    last seen2020-06-05
    modified2014-06-13
    plugin id75142
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75142
    titleopenSUSE Security Update : squid3 (openSUSE-SU-2013:1441-1)
  • NASL familyFirewalls
    NASL idSQUID_3_2_12.NASL
    descriptionAccording to its banner, the version of Squid running on the remote host is 3.x prior to 3.2.12 or 3.3.x prior to 3.3.7 and is, therefore, affected by a denial of service vulnerability. A buffer overflow exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id69041
    published2013-07-24
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69041
    titleSquid 3.x < 3.2.12 / 3.3.x < 3.3.7 idnsALookup HTTP Request DoS
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_SQUID-130909.NASL
    descriptionThis squid update fixes a buffer overflow issue when squid attempts to resolve an overly long hostname. This can be triggered with specially crafted http requests. (bnc#829084, CVE-2013-4115) This update also includes a correction to the last change for logrotate. (bnc#677335)
    last seen2020-06-05
    modified2013-09-20
    plugin id70021
    published2013-09-20
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/70021
    titleSuSE 11.2 / 11.3 Security Update : squid (SAT Patch Numbers 8309 / 8310)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-13468.NASL
    descriptionThis is security update that fixes CVE-2013-4123 and CVE-2013-4115. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-08-05
    plugin id69201
    published2013-08-05
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69201
    titleFedora 19 : squid-3.2.13-1.fc19 (2013-13468)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2014-1148.NASL
    descriptionAn updated squid package that fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609) A buffer overflow flaw was found in Squid
    last seen2020-06-01
    modified2020-06-02
    plugin id77509
    published2014-09-04
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/77509
    titleCentOS 5 / 6 : squid (CESA-2014:1148)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20140903_SQUID_ON_SL5_X.NASL
    descriptionA flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609) A buffer overflow flaw was found in Squid
    last seen2020-03-18
    modified2014-09-05
    plugin id77553
    published2014-09-05
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/77553
    titleScientific Linux Security Update : squid on SL5.x, SL6.x i386/x86_64 (20140903)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1996-1.NASL
    descriptionThis update for squid3 fixes the following issues : - Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142) - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782) - CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010) - fix multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395) - CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783) - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553) - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 : - fixes multiple issues in ESI processing (bsc#976556) - CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008) - CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715) - CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773) - Memory leak in squid3 when using external_acl (bsc#976708) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id93271
    published2016-09-02
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93271
    titleSUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-698.NASL
    descriptionThis squid update includes several security fixes and minor changes. - squid-2.7.x-bnc829084-CVE-2013-4115-BO_request_handling. diff Squid advisory SQUID-2013_2, CVE-2013-4115, [bnc#829084] Specially crafted http requests can trigger a buffer overflow when squid attempts to resolve an overly long hostname. - squid-2.7.x-bnc796999-bnc794954-CVE-2012-5643-CVE-2013-0 188-cachemgr_cgi_dos.diff memory leak in cachemgr.cgi known as CVE-2013-0189, which is the underfixed CVE-2012-5643 problem. [bnc#796999] [bnc#794954] - run logrotate as squid:nogroup [bnc#677335]
    last seen2020-06-05
    modified2014-06-13
    plugin id75139
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75139
    titleopenSUSE Security Update : squid (openSUSE-SU-2013:1436-1)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2013-199.NASL
    descriptionMultiple vulnerabilities has been discovered and corrected in squid : Due to incorrect data validation Squid is vulnerable to a buffer overflow attack when processing specially crafted HTTP requests. This problem allows any trusted client or client script who can generate HTTP requests to trigger a buffer overflow in Squid, resulting in a termination of the Squid service (CVE-2013-4115). The updated packages have been patched to correct this issue.
    last seen2020-06-01
    modified2020-06-02
    plugin id69067
    published2013-07-26
    reporterThis script is Copyright (C) 2013-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/69067
    titleMandriva Linux Security Advisory : squid (MDVSA-2013:199)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2014-1148.NASL
    descriptionAn updated squid package that fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609) A buffer overflow flaw was found in Squid
    last seen2020-06-01
    modified2020-06-02
    plugin id77523
    published2014-09-04
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/77523
    titleRHEL 5 / 6 : squid (RHSA-2014:1148)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-13493.NASL
    descriptionThis is security update that fixes CVE-2013-4123 and CVE-2013-4115. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-08-05
    plugin id69204
    published2013-08-05
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69204
    titleFedora 18 : squid-3.2.13-1.fc18 (2013-13493)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2014-411.NASL
    descriptionA flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609) A buffer overflow flaw was found in Squid
    last seen2020-06-01
    modified2020-06-02
    plugin id78354
    published2014-10-12
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/78354
    titleAmazon Linux AMI : squid (ALAS-2014-411)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-699.NASL
    descriptionThis squid update includes several security fixes and minor changes. - squid-3.2.x-11823-bnc829084-CVE-2013-4115.diff fixes a buffer overflow involving very long hostnames. [bnc#829084] CVE-2013-4115 - squid-3.2.x-11823-bnc830319-CVE-2013-4123.diff fixes problems identifying a port number as specified by the client. [bnc#830319] CVE-2013-4123 - run logrotate as squid:nogroup [bnc#677335]
    last seen2020-06-05
    modified2014-06-13
    plugin id75140
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75140
    titleopenSUSE Security Update : squid (openSUSE-SU-2013:1435-1)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2014-433.NASL
    descriptionA flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609) A buffer overflow flaw was found in Squid
    last seen2020-06-01
    modified2020-06-02
    plugin id78658
    published2014-10-24
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/78658
    titleAmazon Linux AMI : squid (ALAS-2014-433)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-2089-1.NASL
    descriptionThis update for squid3 fixes the following issues : - Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142) - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782) - CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010) - Fix multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395) - Regression caused by the DoS fixes above (bsc#993299) - CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783) - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553) - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 : - fixes multiple issues in ESI processing (bsc#976556) - CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008) - CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715) - CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773) - Memory leak in squid3 when using external_acl (bsc#976708) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id93294
    published2016-09-02
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93294
    titleSUSE SLES11 Security Update : squid3 (SUSE-SU-2016:2089-1)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201309-22.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201309-22 (Squid: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Squid. Please review the CVE identifiers referenced below for details. Impact : A remote attacker may be able to bypass ACL restrictions or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id70182
    published2013-09-28
    reporterThis script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/70182
    titleGLSA-201309-22 : Squid: Multiple vulnerabilities

Redhat

rpms
  • squid-7:2.6.STABLE21-7.el5_10
  • squid-7:3.1.10-22.el6_5
  • squid-debuginfo-7:2.6.STABLE21-7.el5_10
  • squid-debuginfo-7:3.1.10-22.el6_5