PT-2014-3489 · Squid+4 · Squid+5

Published 2014-03-16 · Updated 2018-10-30 · CVE-2014-0128

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid versions 3.1 through 3.3.11 Squid versions 3.4 through 3.4.3

Description The issue allows remote attackers to cause a denial of service, resulting in an assertion failure, via a crafted range request when SSL-Bump is enabled. This is related to state management.

Recommendations For Squid versions 3.1 through 3.3.11, update to version 3.3.12 or later. For Squid versions 3.4 through 3.4.3, update to version 3.4.4 or later. As a temporary workaround, consider disabling the SSL-Bump feature until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2014-1298

CESA-2014_0597

CVE-2014-0128

MGASA-2014-0168

MGASA-2014-0192

RHSA-2014:0597

RHSA-2014_0597

SUSE-SU-2014_0569-1

SUSE-SU-2016:2089-1

Affected Products

Alt Linux

Centos

Red Hat

Squid

Squid Cache

Suse

References · 88

• https://nvd.nist.gov/vuln/detail/CVE-2014-0128 · Security Note
• https://ubuntu.com/security/CVE-2014-0128 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-April/130987.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-0597.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-0128 · Security Note
• http://squid-cache.org/Advisories/SQUID-2014_1.txt · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0192.html · Security Note
• http://lists.opensuse.org/opensuse-updates/2014-04/msg00030.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3609 · Security Note
• http://secunia.com/advisories/57889 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2089-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0128 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0192 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0168 · Vendor Advisory