PT-2019-5770 · Squid+7 · Squid+8
David Fifield
·
Publicado
2019-11-14
·
Atualizado
2024-06-15
·
CVE-2019-18679
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Squid versions 2.x through 4.8
Description
The issue is related to incorrect data management in HTTP Digest Authentication processing, leading to information disclosure. Nonce tokens contain raw byte values of pointers within heap memory allocation, which reduces ASLR protections and may aid attackers in isolating memory areas for remote code execution attacks. This vulnerability allows a remote attacker to access confidential data.
Recommendations
For Squid versions 2.x through 4.8, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Squid
Squid Cache
Suse
Ubuntu