PT-2016-1430 · Squid+5 · Squid+6

Alex Rousskov · Published 2014-04-24 · Updated 2024-06-15 · CVE-2016-2571

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Squid versions 3.x through 3.5.14 Squid versions 4.x through 4.0.6

Description The issue allows remote HTTP servers to cause a denial of service through a malformed response, resulting in an assertion failure and daemon exit. This occurs due to insufficient input validation in the http.cc component of the Squid proxy server.

Recommendations For Squid versions 3.x through 3.5.14, update to version 3.5.15 or later. For Squid versions 4.x through 4.0.6, update to version 4.0.7 or later. As a temporary workaround, consider restricting access to the http.cc component until a patch is available.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2014-1531

ALT-PU-2015-1383

BDU:2016-00731

CESA-2016_2600

CVE-2016-2571

DLA-445-1

DSA-3522-1

MGASA-2016-0095

OPENSUSE-SU-2024:11403-1

RHSA-2016:2600

RHSA-2016_2600

SUSE-SU-2016:2008-1

SUSE-SU-2016:2089-1

USN-2921-1

USN-3557-1

Affected Products

Alt Linux

Centos

Red Hat

Squid

Squid Cache

Suse

Ubuntu

References · 167

• 🔥 https://github.com/amit-raut/CVE-2016-2569 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2570 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2572 · Security Note
• https://advisories.mageia.org/MGASA-2016-0095.html · Security Note
• https://errata.altlinux.org/ALT-PU-2015-1383 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2571 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2921-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04283 · Security Note
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2569 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11403-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00731 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7141 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5400 · Security Note
• https://usn.ubuntu.com/3557-1 · Vendor Advisory