PT-2019-5327 · Squid+7 · Squid+8
Published
2019-07-11
·
Updated
2024-06-15
·
CVE-2019-12527
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Squid versions 4.0.23 through 4.7
Description
The issue is related to a heap-based buffer overflow in the HttpHeader::getAuth function of the Squid proxy server. This occurs because Squid uses a global buffer to store decoded data when checking Basic Authentication, but it does not verify that the decoded length is not greater than the buffer. This can allow a remote attacker to cause a denial of service or execute arbitrary code. The vulnerability can potentially be exploited to execute code with the rights of the server process.
Recommendations
For Squid versions 4.0.23 through 4.7, update to version 4.8 or later, which includes the fix for this issue. As a temporary workaround, consider restricting access to the
HttpHeader::getAuth function until a patch is available. Avoid using the vulnerable function to minimize the risk of exploitation.Exploit
Fix
Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Squid
Squid Cache
Suse
Ubuntu