Date: Thu, 19 Apr 2018 00:45:18 +1200 From: Amos Jeffries <squid3@...enet.co.nz> To: oss-security@...ts.openwall.com Subject: CVE-2018-1172 Squid Proxy Cache Denial of Service vulnerability __________________________________________________________________ Squid Proxy Cache Security Update Advisory SQUID-2018:3 __________________________________________________________________ Advisory ID: SQUID-2018:3 Date: April 18, 2018 Summary: Denial of Service issue in ESI Response processing. Affected versions: Squid 22.214.171.124 -> 3.1.23 Squid 126.96.36.199 -> 3.2.14 Squid 3.3 -> 4.0.12 Fixed in version: Squid 4.0.13 __________________________________________________________________ http://www.squid-cache.org/Advisories/SQUID-2018_3.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1172 __________________________________________________________________ Problem Description: Due to incorrect pointer handling Squid is vulnerable to denial of service attack when processing ESI responses. __________________________________________________________________ Severity: This problem allows a remote server delivering ESI responses to trigger a denial of service for all clients accessing the Squid service. This problem is limited to Squid operating as reverse proxy. __________________________________________________________________ Updated Packages: This bug is fixed by Squid version 4.0.13. In addition, patches addressing this problem for the stable releases can be found in our patch archives: Squid 3.5: <http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_3.patch> If you are using a prepackaged version of Squid then please refer to the package vendor for availability information on updated packages. __________________________________________________________________ Determining if your version is vulnerable: All Squid-2.x and older are not vulnerable. All Squid-3.0 and older version are not vulnerable. All Squid built with --disable-esi are not vulnerable. All Squid-3.x versions up to and including 3.4.14 built with --disable-ssl are not vulnerable. All Squid-3.x versions up to and including 3.4.14 built without --enable-ssl are not vulnerable. All Squid-3.x versions up to and including 3.5.27 built without --enable-esi are not vulnerable. All Squid-188.8.131.52 and later versions up to and including Squid-3.1.23 built with --enable-esi and--enable-ssl, and being used for reverse-proxy are vulnerable. All Squid-184.108.40.206 and later versions up to and including Squid-3.2.14 built with --enable-esi and --enable-ssl, and being used for reverse-proxy are vulnerable. All Squid-3.3 and later versions up to and including Squid-3.3.14 built with --enable-esi and --enable-ssl, and being used for reverse-proxy are vulnerable. All Squid-3.4 and later versions up to and including Squid-3.4.14 built with --enable-esi and --enable-ssl, and being used for reverse-proxy are vulnerable. All Squid-3.5 versions up to and including 3.5.27 built without --with-openssl are not vulnerable. All Squid-3.5 and later versions up to and including 3.5.27 built with --enable-esi and --with-openssl, and being used for reverse-proxy are vulnerable. All Squid-4 versions up to and including 4.0.12 built without --with-openssl are not vulnerable. All Squid-4 versions up to and including 4.0.12 built with --with-openssl and being used for reverse-proxy are vulnerable. __________________________________________________________________ Workarounds: Either; Build Squid with --disable-esi Or, Build Squid-3.1 to 3.4.14 or later with "--disable-ssl" Or, Build Squid-3.5 or later with "--without-openssl" __________________________________________________________________ Contact details for the Squid project: For installation / upgrade support on binary packaged versions of Squid: Your first point of contact should be your binary package vendor. If your install and build Squid from the original Squid sources then the squid-users@...ts.squid-cache.org mailing list is your primary support point. For subscription details see <http://www.squid-cache.org/Support/mailing-lists.html>. For reporting of non-security bugs in the latest STABLE release the squid bugzilla database should be used <http://bugs.squid-cache.org/>. For reporting of security sensitive bugs send an email to the squid-bugs@...ts.squid-cache.org mailing list. It's a closed list (though anyone can post) and security related bug reports are treated in confidence until the impact has been established. __________________________________________________________________ Credits: This vulnerability was discovered by Michael Marshall of Trend Micro working with Trend Micro's Zero Day Initiative. Fixed by Christos Tsantilas on behalf of Measurement Factory. __________________________________________________________________ Revision history: 2018-04-16 18:20:15 UTC Initial Report 2018-04-16 22:02:25 UTC Patches Released 2018-04-18 12:28:00 UTC Advisory Released __________________________________________________________________ END Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ