PT-2016-5773 · Squid+5 · Squid+6

Santiago Ruano Rincón · Publicado 2014-04-24 · Atualizado 2018-03-16 · CVE-2016-3948

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Squid versions 3.x through 3.5.15 Squid versions 4.x through 4.0.7

Description The issue is related to improper bounds checking, which can be exploited by remote attackers to cause a denial of service via a crafted HTTP response. This is specifically related to Vary headers.

Recommendations For Squid versions 3.x through 3.5.15, update to version 3.5.16 or later. For Squid versions 4.x through 4.0.7, update to version 4.0.8 or later.

Exploit

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2014-1531

ALT-PU-2016-1444

CESA-2016_2600

CVE-2016-3948

DSA-3625-1

MGASA-2016-0133

RHSA-2016:2600

RHSA-2016_2600

SUSE-SU-2016:2008-1

SUSE-SU-2016:2089-1

USN-3557-1

Produtos afetados

Alt Linux

Centos

Red Hat

Squid

Squid Cache

Suse

Ubuntu

Referências · 133

• 🔥 https://github.com/amit-raut/CVE-2016-2569 · Exploit
• http://squid-cache.org/Advisories/SQUID-2016_4.txt · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-2600.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-4555 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2016-November/023241.html · Nota
• https://bugzilla.suse.com/968392 · Nota
• https://suse.com/security/cve/CVE-2016-4054 · Nota
• https://ubuntu.com/security/CVE-2016-2570 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-4096 · Nota
• https://suse.com/security/cve/CVE-2016-2570 · Nota
• https://bugzilla.suse.com/968395 · Nota
• https://suse.com/security/cve/CVE-2016-4556 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2572 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10002 · Nota de Segurança
• https://bugzilla.suse.com/895773 · Nota