PT-2016-1319 · Squid+3 · Squid+4

Alex Rousskov · Publicado 2016-02-27 · Atualizado 2018-01-05 · CVE-2016-2572

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Squid versions 4.0.0 through 4.0.6

Description The issue exists due to insufficient input validation in the http.cc proxy server function. It allows a remote attacker to cause a denial of service, resulting in an "Assertion failure" error and termination of the daemon, by sending a malformed response.

Recommendations For Squid versions 4.0.0 through 4.0.6, update to version 4.0.7 or later to resolve the issue.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-00618

CESA-2016_2600

CVE-2016-2572

RHSA-2016:2600

RHSA-2016_2600

SUSE-SU-2016:2008-1

SUSE-SU-2016:2089-1

Produtos afetados

Centos

Red Hat

Squid

Squid Cache

Suse

Referências · 89

• 🔥 https://github.com/amit-raut/CVE-2016-2569 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2570 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/02/26/2 · Nota
• https://suse.com/security/cve/CVE-2016-4052 · Nota
• https://osv.dev/vulnerability/CVE-2016-2572 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2572 · Nota de Segurança
• https://suse.com/security/cve/CVE-2015-3455 · Nota
• https://suse.com/security/cve/CVE-2016-4054 · Nota
• https://suse.com/security/cve/CVE-2016-2570 · Nota
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-2572 · Nota de Segurança
• https://bugzilla.suse.com/968394 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2569 · Nota de Segurança
• https://bugzilla.suse.com/979009 · Nota
• https://suse.com/support/update/announcement/2016/suse-su-20162008-1 · Nota