PT-2016-1724 · Squid+2 · Squid+3

Fabian Hugelshofer + 1 · Publicado 2016-03-15 · Atualizado 2016-11-28 · CVE-2016-2390

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Squid versions prior to 3.5.14 Squid versions 4.0.x prior to 4.0.6

Description The issue arises from insufficient input validation in the FwdState::connectedToPeer method of the Squid proxy server. This can be exploited by a remote attacker to cause a denial of service, resulting in the application crashing, by sending an unencrypted HTTP message.

Recommendations For Squid versions prior to 3.5.14, update to version 3.5.14 or later to resolve the issue. For Squid versions 4.0.x prior to 4.0.6, update to version 4.0.6 or later to resolve the issue.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2016-1253

BDU:2016-01050

CVE-2016-2390

SUSE-SU-2016:2089-1

Produtos afetados

Alt Linux

Squid

Squid Cache

Suse

Referências · 62

• https://suse.com/security/cve/CVE-2016-4555 · Nota
• https://bugzilla.suse.com/968392 · Nota
• https://suse.com/security/cve/CVE-2016-4054 · Nota
• https://suse.com/security/cve/CVE-2011-4096 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2390 · Nota
• https://suse.com/security/cve/CVE-2016-2570 · Nota
• https://bugzilla.suse.com/968395 · Nota
• https://suse.com/security/cve/CVE-2016-4556 · Nota
• https://bugzilla.suse.com/895773 · Nota
• https://security-tracker.debian.org/tracker/CVE-2016-2390 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-01050 · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-4052 · Nota
• https://bugzilla.suse.com/976553 · Nota
• https://suse.com/security/cve/CVE-2016-2569 · Nota
• http://squid-cache.org/Advisories/SQUID-2016_1.txt · Aviso do Fabricante