PT-2020-5158 · Squid+7 · Squid+8
Jeriko One
·
Published
2020-02-04
·
Updated
2024-06-15
·
CVE-2019-12528
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Squid versions prior to 4.10
Description
The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to gain access to sensitive information by sending specially crafted requests. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.
Recommendations
For Squid versions prior to 4.10, update to version 4.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the FTP server to minimize the risk of exploitation. Avoid using the vulnerable Squid proxy server until the issue is resolved.
Fix
Buffer Overflow
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Squid
Squid Cache
Suse
Ubuntu