PT-2016-1430 · Squid+5 · Squid+6

Alex Rousskov · Publicado 2014-04-24 · Atualizado 2024-06-15 · CVE-2016-2571

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Squid versions 3.x through 3.5.14 Squid versions 4.x through 4.0.6

Description The issue allows remote HTTP servers to cause a denial of service through a malformed response, resulting in an assertion failure and daemon exit. This occurs due to insufficient input validation in the http.cc component of the Squid proxy server.

Recommendations For Squid versions 3.x through 3.5.14, update to version 3.5.15 or later. For Squid versions 4.x through 4.0.6, update to version 4.0.7 or later. As a temporary workaround, consider restricting access to the http.cc component until a patch is available.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2014-1531

ALT-PU-2015-1383

BDU:2016-00731

CESA-2016_2600

CVE-2016-2571

DLA-445-1

DSA-3522-1

MGASA-2016-0095

OPENSUSE-SU-2024:11403-1

RHSA-2016:2600

RHSA-2016_2600

SUSE-SU-2016:2008-1

SUSE-SU-2016:2089-1

USN-2921-1

USN-3557-1

Produtos afetados

Alt Linux

Centos

Red Hat

Squid

Squid Cache

Suse

Ubuntu

Referências · 167

• 🔥 https://github.com/amit-raut/CVE-2016-2569 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2570 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/02/26/2 · Nota
• http://openwall.com/lists/oss-security/2015/07/17/14 · Nota
• https://suse.com/security/cve/CVE-2019-12519 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2572 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2016-0095.html · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2015-1383 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2571 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2921-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-2570 · Nota
• https://bdu.fstec.ru/vul/2015-04283 · Nota de Segurança
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2569 · Nota de Segurança
• https://suse.com/security/cve/CVE-2021-28651 · Nota