PT-2016-1724 · Squid+2 · Squid+3

Fabian Hugelshofer + 1 · Published 2016-03-15 · Updated 2016-11-28 · CVE-2016-2390

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Squid versions prior to 3.5.14 Squid versions 4.0.x prior to 4.0.6

Description The issue arises from insufficient input validation in the FwdState::connectedToPeer method of the Squid proxy server. This can be exploited by a remote attacker to cause a denial of service, resulting in the application crashing, by sending an unencrypted HTTP message.

Recommendations For Squid versions prior to 3.5.14, update to version 3.5.14 or later to resolve the issue. For Squid versions 4.0.x prior to 4.0.6, update to version 4.0.6 or later to resolve the issue.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2016-1253

BDU:2016-01050

CVE-2016-2390

SUSE-SU-2016:2089-1

Affected Products

Alt Linux

Squid

Squid Cache

Suse

References · 62

• https://security-tracker.debian.org/tracker/CVE-2016-2390 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01050 · Security Note
• http://squid-cache.org/Advisories/SQUID-2016_1.txt · Vendor Advisory
• http://lists.squid-cache.org/pipermail/squid-announce/2016-February/000038.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-1253 · Vendor Advisory
• http://lists.squid-cache.org/pipermail/squid-announce/2016-February/000037.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2390 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2390 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2390 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2089-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2390 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-4555 · Note
• https://bugzilla.suse.com/968392 · Note