Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 4 Oct 2021 14:31:52 +1300
From: Amos Jeffries <squid3@...enet.co.nz>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-28116 / ZDI-CAN-11610 / SQUID-2020:12 Out-Of-Bounds memory
 access in WCCPv2

__________________________________________________________________

### Squid Proxy Cache Security Update Advisory SQUID-2020:12
__________________________________________________________________

Advisory ID:       | SQUID-2020:12
Date:              | Oct 03, 2021
Summary:           | Out-Of-Bounds memory access in WCCPv2
Affected versions: | Squid 2.6 -> 2.7.STABLE9
                    | Squid 3.x -> 3.5.28
                    | Squid 4.x -> 4.16
                    | Squid 5.x -> 5.1
Fixed in version:  | Squid 4.17 and 5.2
__________________________________________________________________

   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28116>
   <https://www.zerodayinitiative.com/advisories/ZDI-CAN-11610>
__________________________________________________________________

### Problem Description:

  Due to an out of bounds memory access Squid is vulnerable to an
  information leak vulnerability when processing WCCPv2 messages.

__________________________________________________________________

### Severity:

  This problem allows a WCCPv2 sender to corrupt Squids list of
  known WCCP routers and divert client traffic to attacker
   controlled routers.

  This attack is limited to Squid proxy with WCCPv2 enabled and
  IP spoofing of a router IP address configured as trusted in
  squid.conf.

CVSS Score of 7.7
<https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:X/RL:O/RC:C/CR:H/IR:H/AR:X/MAV:N/MAC:H/MPR:N/MUI:X/MS:U/MC:H/MI:H/MA:X&version=3.1>

__________________________________________________________________

### Updated Packages:

#### This bug is fixed by Squid versions 4.17 and 5.2.

  In addition, patches addressing this problem for the stable
  releases can be found in our patch archives:

#### Squid 4:
  <http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_12.patch>

#### Squid 5:
 
<http://www.squid-cache.org/Versions/v5/changesets/squid-5-7a73a54cefff6bb83c03de219a73276e42d183d0.patch>

  If you are using a prepackaged version of Squid then please
  refer to the package vendor for availability information on
  updated packages.

__________________________________________________________________

### Determining if your version is vulnerable:

  All Squid built with --disable-wccpv2 are not vulnerable.

  All Squid-3.x up to and including 3.5.28 built with
  --enable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

  All Squid-3.x up to and including 3.5.28 built without
  --disable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

  All Squid-4.x up to and including 4.16 built with
  --enable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

  All Squid-4.x up to and including 4.16 built without
  --disable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

  All Squid-5.x up to and including 5.1 built with
  --enable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

  All Squid-5.x up to and including 5.1 built without
  --disable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

__________________________________________________________________

### Workaround:

Either,

The following network security Best Practices will greatly
restrict the ability of any attacker utilizing this
vulnerability. They can be considered workarounds for this
issue:

  * Use Private IP address for control communications (eg WCCPv2)
    with routers.

  * Firewall restriction of UDP traffic on port 2048 and any
    other UDP ports used for WCCP(v2) control messages to only
    permit known devices to communicate with WCCP(v2).

    Note that ports used by clients and diverted by WCCP (eg 80
    or 443) are not relevant.

  * Ensure the network implements BCP 38 spoofing protection.
    Include protection against LAN traffic spoofing as much as
    possible.
    See also <http://www.bcp38.info> and 
<https://tools.ietf.org/html/bcp38>.

Or,

  Build Squid with --disable-wccpv2

Or,

  Remove all lines for wccp2_* directives from squid.conf.
  The default configuration is not to enable WCCPv2.

__________________________________________________________________

### Contact details for the Squid project:

  For installation / upgrade support on binary packaged versions
  of Squid: Your first point of contact should be your binary
  package vendor.

  If you install and build Squid from the original Squid sources
  then the <squid-users@...ts.squid-cache.org> mailing list is
  your primary support point. For subscription details see
  <http://www.squid-cache.org/Support/mailing-lists.html>.

  For reporting of non-security bugs in the latest STABLE release
  the squid bugzilla database should be used
  <http://bugs.squid-cache.org/>.

  For reporting of security sensitive bugs send an email to the
  <squid-bugs@...ts.squid-cache.org> mailing list. It's a closed
  list (though anyone can post) and security related bug reports
  are treated in confidence until the impact has been established.

__________________________________________________________________

### Credits:

  This vulnerability was discovered by Lyu working with Trend
  Micro Zero Day Initiative.

  Fixed by Amos Jeffries of Treehouse Networks Ltd.

__________________________________________________________________

### Revision history:

  2020-08-17 10:43:36 UTC Initial Report
  2021-02-09 00:00:00 UTC Advisory Release by ZDI
  2021-10-03 00:00:00 UTC Packages Released

__________________________________________________________________
END

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.