PT-2021-3105 · Squid+8 · Squid+9

Joshua Rogers · Published 2021-05-10 · Updated 2023-10-24 · CVE-2021-31808

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Squid versions prior to 4.15 Squid versions 5.x prior to 5.0.6

Description The issue exists due to insufficient validation of user-input data when delivering responses to HTTP range requests. This can be exploited by a remote attacker to cause a denial of service. A client can send an HTTP Range request to trigger this issue.

Recommendations For Squid versions prior to 4.15, update to version 4.15 or later. For Squid versions 5.x prior to 5.0.6, update to version 5.0.6 or later. As a temporary workaround, consider restricting access to HTTP Range requests until a patch is available.

Exploit

Fix

DoS

RCE

Integer Overflow

Weakness Enumeration

CWE-20

CWE-190

Related Identifiers

ALSA-2021:4292

ALT-PU-2021-2058

ALT-PU-2021-2829

BDU:2021-02728

CESA-2021_4292

CVE-2021-31808

DLA-2685-1

DSA-4924-1

GHSA-PXWQ-F3QR-W2XF

MGASA-2021-0237

OESA-2021-1240

RHSA-2021:4292

RHSA-2021_4292

RLSA-2021:4292

USN-4981-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Squid

Squid Cache

Ubuntu

References · 81

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/squid_range_dos.rb · Exploit
• 🔥 http://squid-cache.org/Versions/v4/changesets/squid-4-e7cf864f938f24eea8af0692c04d16790983c823.patch · Exploit
• https://github.com/squid-cache/squid/security/advisories/GHSA-pxwq-f3qr-w2xf · Patch
• https://osv.dev/vulnerability/USN-4981-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33620 · Security Note
• https://linux.oracle.com/errata/ELSA-2021-9465.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4EPIWUZDJAXADDHVOPKRBTQHPBR6H66 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-28651 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0237 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0237.html · Security Note
• https://osv.dev/vulnerability/DLA-2685-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31806 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQ3U54ZCNXR44QRPW3AV2VCS6K3TKCF · Vendor Advisory