Vulnerabilities > CVE-2019-18676 - Out-of-bounds Write vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH

Summary

An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a crafted URI scheme.

Vulnerable Configurations

Part Description Count
Application
Squid-Cache
212
OS
Canonical
5
OS
Fedoraproject
2
OS
Debian
2

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1034.NASL
    descriptionAccording to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn
    last seen2020-05-03
    modified2020-01-02
    plugin id132627
    published2020-01-02
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132627
    titleEulerOS 2.0 SP8 : squid (EulerOS-SA-2020-1034)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4213-1.NASL
    descriptionJeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled certain URN requests. A remote attacker could possibly use this issue to bypass access checks and access restricted servers. This issue was only addressed in Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-12523) Jeriko One discovered that Squid incorrectly handed URN responses. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-12526) Alex Rousskov discovered that Squid incorrectly handled certain strings. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 19.04. (CVE-2019-12854) Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled certain input. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue was only addressed in Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-18676) Kristoffer Danielsson discovered that Squid incorrectly handled certain messages. This issue could result in traffic being redirected to origins it should not be delivered to. (CVE-2019-18677) Regis Leroy discovered that Squid incorrectly handled certain HTTP request headers. A remote attacker could use this to smuggle HTTP requests and corrupt caches with arbitrary content. (CVE-2019-18678) David Fifield discovered that Squid incorrectly handled HTTP Digest Authentication. A remote attacker could possibly use this issue to obtain pointer contents and bypass ASLR protections. (CVE-2019-18679). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id131723
    published2019-12-05
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131723
    titleUbuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : squid, squid3 vulnerabilities (USN-4213-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2541.NASL
    descriptionThis update for squid to version 4.9 fixes the following issues : Security issues fixed : - CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738). - CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326). - CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329). - CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328). - CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323). - CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324). Other issues addressed : - Fixed DNS failures when peer name was configured with any upper case characters - Fixed several rock cache_dir corruption issues This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id131220
    published2019-11-22
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131220
    titleopenSUSE Security Update : squid (openSUSE-2019-2541)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4682.NASL
    descriptionMultiple security issues were discovered in the Squid proxy caching server, which could result in the bypass of security filters, information disclosure, the execution of arbitrary code or denial of service.
    last seen2020-05-15
    modified2020-05-11
    plugin id136430
    published2020-05-11
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136430
    titleDebian DSA-4682-1 : squid - security update
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2020-0661-1.NASL
    descriptionThis update for squid fixes the following issues : CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway (bsc#1162689). CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326). CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329). CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328). CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323). CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324). CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687). CVE-2020-8450: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687). CVE-2020-8517: Fixed a buffer overflow in ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-19
    modified2020-03-13
    plugin id134561
    published2020-03-13
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134561
    titleSUSE SLES12 Security Update : squid (SUSE-SU-2020:0661-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-2975-1.NASL
    descriptionThis update for squid to version 4.9 fixes the following issues : Security issues fixed : CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738). CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326). CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329). CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328). CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323). CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324). Other issues addressed : - Fixed DNS failures when peer name was configured with any upper case characters - Fixed several rock cache_dir corruption issues Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id131070
    published2019-11-15
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131070
    titleSUSE SLES15 Security Update : squid (SUSE-SU-2019:2975-1)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1133.NASL
    descriptionAccording to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.(CVE-2019-18679) - An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.(CVE-2019-18677) - An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks any remote client that can reach the proxy port can trivially perform the attack via a crafted URI scheme.(CVE-2019-18676) - An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon.(CVE-2019-18678) - An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap.(CVE-2019-12526) - An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn
    last seen2020-05-06
    modified2020-02-24
    plugin id133934
    published2020-02-24
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133934
    titleEulerOS 2.0 SP5 : squid (EulerOS-SA-2020-1133)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-3067-1.NASL
    descriptionThis update for squid to version 4.9 fixes the following issues : Security issues fixed : CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738). CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326). CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329). CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328). CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323). CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324). Other issues addressesd : - Fixed DNS failures when peer name was configured with any upper case characters - Fixed several rock cache_dir corruption issues Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id131386
    published2019-11-27
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131386
    titleSUSE SLES12 Security Update : squid (SUSE-SU-2019:3067-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-0B16CBDD0E.NASL
    descriptionNew version update - squid 4.9 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id131707
    published2019-12-05
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131707
    titleFedora 30 : 7:squid (2019-0b16cbdd0e)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-9538783033.NASL
    descriptionNew version update - squid 4.9 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id131714
    published2019-12-05
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131714
    titleFedora 31 : 7:squid (2019-9538783033)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2540.NASL
    descriptionThis update for squid to version 4.9 fixes the following issues : Security issues fixed : - CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738). - CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326). - CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329). - CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328). - CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323). - CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324). Other issues addressed : - Fixed DNS failures when peer name was configured with any upper case characters - Fixed several rock cache_dir corruption issues This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id131219
    published2019-11-22
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131219
    titleopenSUSE Security Update : squid (openSUSE-2019-2540)