PT-2022-6446 · Squid+10 · Squid+11

Published 2022-09-18 · Updated 2024-06-27 · CVE-2022-41318

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Squid versions 2.5 through 5.6

Description A buffer over-read was discovered in libntlmauth due to incorrect integer-overflow protection, making the SSPI and SMB authentication helpers vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client.

Recommendations For Squid versions 2.5 through 5.6, update to version 5.7 to resolve the issue. As a temporary workaround, consider restricting access to the SSPI and SMB authentication helpers until a patch is available. Avoid using configurations that may send cleartext credentials to a client.

Fix

Integer Overflow

Out of bounds Read

Buffer Over-read

Weakness Enumeration

CWE-190

CWE-125

CWE-126

Related Identifiers

ALSA-2022:6775

ALSA-2022:6839

ALT-PU-2022-2631

ALT-PU-2023-5843

ALT-PU-2023-6467

ALT-PU-2024-9370

BDU:2023-01309

CESA-2022_6775

CESA-2022_6815

CVE-2022-41318

DLA-3151-1

DSA-5258-1

GHSA-394C-RR7Q-6G78

MGASA-2022-0351

OESA-2022-1974

OPENSUSE-SU-2022_3531-1

OPENSUSE-SU-2022_3596-1

OPENSUSE-SU-2024:12364-1

RHSA-2022:6774

RHSA-2022:6775

RHSA-2022:6776

RHSA-2022:6777

RHSA-2022:6815

RHSA-2022:6839

RHSA-2022_6775

RHSA-2022_6815

RHSA-2022_6839

RLSA-2022:6775

RLSA-2022:6839

ROSA-SA-2023-2273

SUSE-SU-2022:3531-1

SUSE-SU-2022:3532-1

SUSE-SU-2022:3533-1

SUSE-SU-2022:3596-1

USN-5641-1

USN-6857-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Squid

Squid Cache

Suse

Ubuntu

References · 77

• https://github.com/squid-cache/squid/security/advisories/GHSA-394c-rr7q-6g78 · Patch
• https://bdu.fstec.ru/vul/2023-01309 · Security Note
• https://osv.dev/vulnerability/USN-6857-1 · Vendor Advisory
• https://openwall.com/lists/oss-security/2022/09/23/2 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:12364-1 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2022-6839.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3596-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0351 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5641-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/B7XECSLCZXLV6UDNWQC6K4VDPHVWWTNP · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-50269 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-41318 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2OLQYYQIPMZD5W2FSOW27YSZJU5PCA73 · Vendor Advisory