PT-2017-7668 · Squid+5 · Squid Http Proxy+6

Saulius Lapinskas · Published 2014-04-24 · Updated 2024-06-15 · CVE-2016-10002

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Squid HTTP Proxy versions 3.1.10 through 3.1.23 Squid HTTP Proxy versions 3.2.0.3 through 3.5.22 Squid HTTP Proxy versions 4.0.1 through 4.0.16

Description The issue arises from the incorrect processing of responses to If-None-Modified HTTP conditional requests, leading to the leakage of client-specific Cookie data to other clients. An attacker can craft requests to probe a cache for this sensitive information.

Recommendations For Squid HTTP Proxy versions 3.1.10 through 3.1.23, update to a version outside of this range to mitigate the issue. For Squid HTTP Proxy versions 3.2.0.3 through 3.5.22, update to a version outside of this range to mitigate the issue. For Squid HTTP Proxy versions 4.0.1 through 4.0.16, update to a version outside of this range to mitigate the issue. As a temporary workaround, consider restricting access to the cache to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2014-1531

ALT-PU-2016-2464

CESA-2017_0182

CESA-2017_0183

CVE-2016-10002

DLA-763-1

DSA-3745-1

MGASA-2016-0423

OPENSUSE-SU-2024:11403-1

RHSA-2017:0182

RHSA-2017:0183

RHSA-2017_0182

RHSA-2017_0183

SUSE-SU-2017:0110-1

SUSE-SU-2017:0116-1

SUSE-SU-2017:0128-1

USN-3192-1

Affected Products

Alt Linux

Centos

Red Hat

Squid Cache

Squid Http Proxy

Suse

Ubuntu

References · 117

• 🔥 https://github.com/amit-raut/CVE-2016-2569 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-10002 · Security Note
• http://squid-cache.org/Advisories/SQUID-2016_11.txt · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2016-10002 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/12/18/1 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10002 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3745-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0116-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10002 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0423 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7141 · Security Note
• https://osv.dev/vulnerability/USN-3192-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10003 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2017-0183.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00731 · Security Note