PT-2015-6236 · Squid+4 · Squid+5

Publicado 2014-04-24 · Atualizado 2019-12-27 · CVE-2015-3455

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Squid versions 3.2.x through 3.2.13 Squid versions 3.3.x through 3.3.13 Squid versions 3.4.x through 3.4.12 Squid versions 3.5.x through 3.5.3

Description The issue arises when Squid is configured with client-first SSL-bump and fails to properly validate the domain or hostname fields of X.509 certificates. This allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.

Recommendations For Squid versions 3.2.x through 3.2.13, update to version 3.2.14 or later. For Squid versions 3.3.x through 3.3.13, update to version 3.3.14 or later. For Squid versions 3.4.x through 3.4.12, update to version 3.4.13 or later. For Squid versions 3.5.x through 3.5.3, update to version 3.5.4 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2014-1531

ALT-PU-2015-1383

CESA-2015_2378

CVE-2015-3455

MGASA-2015-0191

RHSA-2015:2378

RHSA-2015_2378

SUSE-SU-2016:2008-1

Produtos afetados

Alt Linux

Centos

Red Hat

Squid

Squid Cache

Suse

Referências · 94

• 🔥 https://github.com/amit-raut/CVE-2016-2569 · Exploit
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html · Aviso do Fabricante
• https://bugzilla.suse.com/979008 · Nota
• https://bugzilla.suse.com/973783 · Nota
• https://errata.altlinux.org/ALT-PU-2014-1531 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/04/30/2 · Nota
• https://access.redhat.com/errata/RHSA-2015:2378 · Nota
• https://suse.com/security/cve/CVE-2016-4555 · Nota
• https://bugzilla.suse.com/959290 · Nota
• https://bdu.fstec.ru/vul/2016-00732 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2015-0191.html · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2016:2008-1 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2015-09/msg00016.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3455 · Nota
• https://suse.com/security/cve/CVE-2016-2572 · Nota