PT-2016-5773 · Squid+5 · Squid+6

Santiago Ruano Rincón · Published 2014-04-24 · Updated 2018-03-16 · CVE-2016-3948

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Squid versions 3.x through 3.5.15 Squid versions 4.x through 4.0.7

Description The issue is related to improper bounds checking, which can be exploited by remote attackers to cause a denial of service via a crafted HTTP response. This is specifically related to Vary headers.

Recommendations For Squid versions 3.x through 3.5.15, update to version 3.5.16 or later. For Squid versions 4.x through 4.0.7, update to version 4.0.8 or later.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2014-1531

ALT-PU-2016-1444

CESA-2016_2600

CVE-2016-3948

DSA-3625-1

MGASA-2016-0133

RHSA-2016:2600

RHSA-2016_2600

SUSE-SU-2016:2008-1

SUSE-SU-2016:2089-1

USN-3557-1

Affected Products

Alt Linux

Centos

Red Hat

Squid

Squid Cache

Suse

Ubuntu

References · 133

• 🔥 https://github.com/amit-raut/CVE-2016-2569 · Exploit
• http://squid-cache.org/Advisories/SQUID-2016_4.txt · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2600.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2570 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2572 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10002 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4053 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000024 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7141 · Security Note
• https://bdu.fstec.ru/vul/2016-00731 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4554 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:2008-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201607-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00732 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3948 · Security Note