PT-2017-7677 · Squid+3 · Squid Http Proxy+4

Felix Hassert · Published 2016-12-19 · Updated 2024-06-15 · CVE-2016-10003

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Squid HTTP Proxy versions 3.5.0.1 through 3.5.22 Squid HTTP Proxy versions 4.0.1 through 4.0.16

Description The issue arises from an incorrect comparison of HTTP Request headers in the Squid HTTP Proxy, leading to the Collapsed Forwarding feature mistakenly identifying some private responses as suitable for delivery to multiple clients.

Recommendations For Squid HTTP Proxy versions 3.5.0.1 through 3.5.22, update to a version outside of this range to resolve the issue. For Squid HTTP Proxy versions 4.0.1 through 4.0.16, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the Collapsed Forwarding feature until a patch is available.

Fix

Weakness Enumeration

CWE-697

Related Identifiers

ALT-PU-2016-2464

CVE-2016-10003

MGASA-2016-0423

OPENSUSE-SU-2024:11403-1

SUSE-SU-2017:0128-1

USN-3192-1

Affected Products

Alt Linux

Squid Cache

Squid Http Proxy

Suse

Ubuntu

References · 72

• http://openwall.com/lists/oss-security/2016/12/18/1 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10002 · Security Note
• http://squid-cache.org/Advisories/SQUID-2016_10.txt · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0423 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3192-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10003 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3192-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10003 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10002 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10003 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-10003 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2016-10003 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0423.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:0128-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-10003 · Security Note