PT-2014-3489 · Squid+4 · Squid+5

Publicado 2014-03-16 · Atualizado 2018-10-30 · CVE-2014-0128

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid versions 3.1 through 3.3.11 Squid versions 3.4 through 3.4.3

Description The issue allows remote attackers to cause a denial of service, resulting in an assertion failure, via a crafted range request when SSL-Bump is enabled. This is related to state management.

Recommendations For Squid versions 3.1 through 3.3.11, update to version 3.3.12 or later. For Squid versions 3.4 through 3.4.3, update to version 3.4.4 or later. As a temporary workaround, consider disabling the SSL-Bump feature until a patch is available.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2014-1298

CESA-2014_0597

CVE-2014-0128

MGASA-2014-0168

MGASA-2014-0192

RHSA-2014:0597

RHSA-2014_0597

SUSE-SU-2014_0569-1

SUSE-SU-2016:2089-1

Produtos afetados

Alt Linux

Centos

Red Hat

Squid

Squid Cache

Suse

Referências · 88

• https://suse.com/security/cve/CVE-2015-5400 · Nota
• https://lists.centos.org/pipermail/centos-announce/2014-June/069815.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0128 · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-3947 · Nota
• https://suse.com/security/cve/CVE-2012-5643 · Nota
• https://suse.com/security/cve/CVE-2013-4115 · Nota
• https://ubuntu.com/security/CVE-2014-0128 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-4553 · Nota
• https://suse.com/security/cve/CVE-2014-7141 · Nota
• https://suse.com/security/cve/CVE-2016-3948 · Nota
• https://lists.fedoraproject.org/pipermail/package-announce/2014-April/130987.html · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2014-0597.html · Aviso do Fabricante
• https://bugzilla.suse.com/979008 · Nota
• https://suse.com/security/cve/CVE-2016-2572 · Nota
• https://bugzilla.suse.com/976708 · Nota