PT-2019-5500 · Squid+7 · Squid+8

Alex Rousskov · Published 2019-07-15 · Updated 2024-06-15 · CVE-2019-12854

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Squid versions 4.0 through 4.7

Description The issue is related to incorrect string termination in the cachemgr.cgi component of the Squid proxy server, which can lead to accessing unallocated memory. This can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it. The vulnerability is also described as a buffer overflow in memory, which can be exploited by a remote attacker to cause a denial of service.

Recommendations For Squid versions 4.0 through 4.7, consider disabling the cachemgr.cgi component as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALSA-2020:4743

ALT-PU-2019-2264

ALT-PU-2019-2271

BDU:2020-03316

CESA-2020_4743

CVE-2019-12854

DSA-4507-1

MGASA-2019-0266

OPENSUSE-SU-2019:2540-1

OPENSUSE-SU-2019:2541-1

OPENSUSE-SU-2019_2540-1

OPENSUSE-SU-2019_2541-1

OPENSUSE-SU-2024:11403-1

RHSA-2020:4743

RHSA-2020_4743

RLSA-2020:4743

SUSE-SU-2019:2975-1

USN-4213-1

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

Rocky Linux

Squid

Squid Cache

Suse

Ubuntu

References · 133

• http://squid-cache.org/Advisories/SQUID-2019_1.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12854 · Security Note
• https://usn.ubuntu.com/4213-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-18679 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4507-1 · Vendor Advisory
• https://debian.org/security/2019/dsa-4507 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2020-4743.html · Vendor Advisory
• http://squid-cache.org/Versions/v4/changesets/squid-4-2981a957716c61ff7e21eee1d7d6eb5a237e466d.patch · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12854 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4213-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11403-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2541-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4213-1 · Vendor Advisory