このsquidのバージョン4.9への更新では、次の問題を修正します：

キャッシュサイドチャネル攻撃の軽減：

CVE-2019-13345：cachemgr.cgiでの複数のクロスサイトスクリプティングの脆弱性を修正しました（bsc#1140738）。

CVE-2019-12526：URN処理中のリモートコードの実行の可能性を修正しました（bsc#1156326）。

CVE-2019-12523,CVE-2019-18676：URI処理における複数の不適切な検証を修正しました（bsc#1156329）。

CVE-2019-18677：HTTPリクエスト処理でのクロスサイトリクエスト偽造を修正しました（bsc#1156328）。

CVE-2019-18678：HTTPリクエストの分割問題につながっている可能性が修正された不正なメッセージの解析（bsc#1156323）。

CVE-2019-18679：HTTPダイジェスト認証の処理中の情報漏洩を修正しました（bsc#1156324）。

その他の対処された問題：

  - ピア名が大文字を使って構成されていた場合のに発生するDNSエラーを修正しました

  - いくつかのrock cache_dir破損の問題を修正しました

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

新しいバージョンの更新 - squid 4.9

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

リモートホストにインストールされているテスト済み製品のバージョンは、テスト済みバージョンより前です。したがって、ALAS2-2020-1486のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - この脆弱性により、リモート攻撃者が、Squid Software Foundation Squid 3.5.27-20180318の脆弱なインストールでサービスを拒否する可能性があります。この脆弱性を悪用するには、認証は必要ありません。
    この特定の欠陥は、ClientRequestContext: : sslBumpAccessCheck()内に存在します。細工したリクエストで、NULLポインターのデリファレンスをトリガーすることができます。攻撃者が、この脆弱性を利用して、システムのユーザーに対するサービス拒否状態を作り出す可能性があります。ZDI-CAN-6088でした。（CVE-2018-1172）

  - 4.10より前のSquidで問題が発見されました。これにより、細工されたFTPサーバーが、他のユーザーのセッションやSquid以外のプロセスに関連付けられた情報など、ヒープメモリからの機密情報の漏洩をトリガーする可能性があります。（CVE-2019-12528）

  - Squid 2.x、3.x、および4.x～4.8で問題が発見されました。データ管理が不適切なため、これらのSquidは、HTTPダイジェスト認証を処理するときの情報漏洩に対して脆弱です。Nonceトークンには、ヒープメモリ割り当て内に存在するポインターの生のバイト値が含まれています。この情報は、ASLR保護を低下させ、攻撃者がメモリ領域を特定して、リモートコード実行攻撃の標的にするために使用する可能性があります。
    （CVE-2019-18679）

  4.10より前のSquidで問題が発見されました。バッファ管理が不適切なため、リモートクライアントが、リバースプロキシとして動作しているSquidインスタンスでバッファオーバーフローを引き起こす可能性があります。（CVE-2020-8450）

Nessusはこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

リモートのCentOS Linux 8ホストにインストールされているパッケージは、CESA-2020: 4743のアドバイザリに記載されている脆弱性の影響を受けます。

  - Squid: リクエストの不適切な入力検証により、プロキシ操作が可能になります（CVE-2019-12520）

  - Squid: addStackElementのoff-by-oneエラーにより、ヒープバッファオーバーフローおよびクラッシュが引き起こされます（CVE-2019-12521）

  - Squid: URIプロセッサでの不適切な入力検証（CVE-2019-12523）

  - Squid: url_regexでの不適切なアクセス制限により、セキュリティバイパスが発生する可能性があります（CVE-2019-12524）

  - Squid: URN処理におけるヒープオーバーフローの問題（CVE-2019-12526）

  - Squid: FTPゲートウェイの情報漏洩の問題（CVE-2019-12528）

  - Squid: Proxy-Authorizationヘッダーの領域外読み取りは、DOSを引き起こします（CVE-2019-12529）

  - Squid: cachemgr.cgiにおけるサービス拒否（CVE-2019-12854）

  - Squid: URIプロセッサでのバッファオーバーフロー（CVE-2019-18676）

  - Squid: HTTPリクエスト処理におけるクロスサイトリクエスト偽造の問題（CVE-2019-18677）

  - Squid: HTTPメッセージ処理におけるHTTPリクエスト分割の問題（CVE-2019-18678）

  - Squid: HTTP Digest認証における情報漏洩の問題（CVE-2019-18679）

  - Squid: cachemgr.cgiに対するホストパラメーターのHTMLが不適切に処理されると、安全でない挙動が発生します（CVE-2019-18860）

  - Squid: TLSハンドシェイクにおけるDoS（CVE-2020-14058）

  - Squid: HTTPキャッシュに対するリクエストスマグリングおよびポイズニング攻撃（CVE-2020-15049）

  - Squid: 不適切な入力検証により、DoSが発生する可能性があります（CVE-2020-24606）

  - Squid: HTTPリクエスト処理における不適切な入力検証の問題（CVE-2020-8449）

  - Squid: リバースプロキシ構成におけるバッファオーバーフロー（CVE-2020-8450）

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Squid before 4.9. When     handling a URN request, a corresponding HTTP request is     made. This HTTP request doesn't go through the access     checks that incoming HTTP requests go through. This     causes all access checks to be bypassed and allows     access to restricted HTTP servers, e.g., an attacker     can connect to HTTP servers that only listen on     localhost.(CVE-2019-12523)

  - An issue was discovered in Squid before 4.9. URN     response handling in Squid suffers from a heap-based     buffer overflow. When receiving data from a remote     server in response to an URN request, Squid fails to     ensure that the response can fit within the buffer.
    This leads to attacker controlled data overflowing in     the heap.(CVE-2019-12526)

  - An issue was discovered in Squid 3.x and 4.x through     4.8. Due to incorrect input validation, there is a     heap-based buffer overflow that can result in Denial of     Service to all clients using the proxy. Severity is     high due to this vulnerability occurring before normal     security checks any remote client that can reach the     proxy port can trivially perform the attack via a     crafted URI scheme.(CVE-2019-18676)

  - An issue was discovered in Squid 3.x and 4.x through     4.8 when the append_domain setting is used (because the     appended characters do not properly interact with     hostname length restrictions). Due to incorrect message     processing, it can inappropriately redirect traffic to     origins it should not be delivered to.(CVE-2019-18677)

  - An issue was discovered in Squid 3.x and 4.x through     4.8. It allows attackers to smuggle HTTP requests     through frontend software to a Squid instance that     splits the HTTP Request pipeline differently. The     resulting Response messages corrupt caches (between a     client and Squid) with attacker-controlled content at     arbitrary URLs. Effects are isolated to software     between the attacker client and Squid. There are no     effects on Squid itself, nor on any upstream servers.
    The issue is related to a request header containing     whitespace between a header name and a     colon.(CVE-2019-18678)

  - An issue was discovered in Squid 2.x, 3.x, and 4.x     through 4.8. Due to incorrect data management, it is     vulnerable to information disclosure when processing     HTTP Digest Authentication. Nonce tokens contain the     raw byte value of a pointer that sits within heap     memory allocation. This information reduces ASLR     protections and may aid attackers isolating memory     areas to target for remote code execution     attacks.(CVE-2019-18679)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Squid 2.x, 3.x, and 4.x     through 4.8. Due to incorrect data management, it is     vulnerable to information disclosure when processing     HTTP Digest Authentication. Nonce tokens contain the     raw byte value of a pointer that sits within heap     memory allocation. This information reduces ASLR     protections and may aid attackers isolating memory     areas to target for remote code execution     attacks.(CVE-2019-18679)

  - An issue was discovered in Squid 3.x and 4.x through     4.8 when the append_domain setting is used (because the     appended characters do not properly interact with     hostname length restrictions). Due to incorrect message     processing, it can inappropriately redirect traffic to     origins it should not be delivered to.(CVE-2019-18677)

  - An issue was discovered in Squid 3.x and 4.x through     4.8. Due to incorrect input validation, there is a     heap-based buffer overflow that can result in Denial of     Service to all clients using the proxy. Severity is     high due to this vulnerability occurring before normal     security checks any remote client that can reach the     proxy port can trivially perform the attack via a     crafted URI scheme.(CVE-2019-18676)

  - An issue was discovered in Squid before 4.12 and 5.x     before 5.0.3. Due to use of a potentially dangerous     function, Squid and the default certificate validation     helper are vulnerable to a Denial of Service when     opening a TLS connection to an attacker-controlled     server for HTTPS. This occurs because unrecognized     error values are mapped to NULL, but later code expects     that each error value is mapped to a valid error     string.(CVE-2020-14058)

  - An issue was discovered in Squid before 4.9. URN     response handling in Squid suffers from a heap-based     buffer overflow. When receiving data from a remote     server in response to an URN request, Squid fails to     ensure that the response can fit within the buffer.
    This leads to attacker controlled data overflowing in     the heap.(CVE-2019-12526)

  - An issue was discovered in Squid before 4.9. When     handling a URN request, a corresponding HTTP request is     made. This HTTP request doesn't go through the access     checks that incoming HTTP requests go through. This     causes all access checks to be bypassed and allows     access to restricted HTTP servers, e.g., an attacker     can connect to HTTP servers that only listen on     localhost.(CVE-2019-12523)

  - An issue was discovered in Squid through 4.13 and 5.x     through 5.0.4. Due to improper input validation, it     allows a trusted client to perform HTTP Request     Smuggling and access services otherwise forbidden by     the security controls. This occurs for certain     uri_whitespace configuration settings.(CVE-2020-25097)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4743 advisory.

  - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to     see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request.
    If found, it servers the request. The absolute URL can include the decoded UserInfo (username and     password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to     provide a username that has special characters to delimit the domain, and treat the rest of the URL as a     path or query string. An attacker could first make a request to their domain using an encoded username,     then when a request for the target domain comes in that decodes to the exact URL, it will serve the     attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows     an attacker to gain access to features that only reverse proxies can use, such as ESI. (CVE-2019-12520)

  - An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in     ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is     parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this     buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same     structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.
    (CVE-2019-12521)

  - An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is     made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This     causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker     can connect to HTTP servers that only listen on localhost. (CVE-2019-12523)

  - An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to     see if the request should be denied. Squid by default comes with rules to block access to the Cache     Manager, which serves detailed server information meant for the maintainer. This rule is implemented via     url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to     encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)

  - An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based     buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to     ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in     the heap. (CVE-2019-12526)

  - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of     sensitive information from heap memory, such as information associated with other users' sessions or non-     Squid processes. (CVE-2019-12528)

  - An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When     Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode.
    uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The     length is then used to start decoding the string. There are no checks to ensure that the length it     calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An     attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the     display of usernames on error pages. (CVE-2019-12529)

  - Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On     systems with memory access protections, this can cause the CGI process to terminate unexpectedly,     resulting in a denial of service for all clients using it. (CVE-2019-12854)

  - An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a     heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity     is high due to this vulnerability occurring before normal security checks; any remote client that can     reach the proxy port can trivially perform the attack via a crafted URI scheme. (CVE-2019-18676)

  - An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because     the appended characters do not properly interact with hostname length restrictions). Due to incorrect     message processing, it can inappropriately redirect traffic to origins it should not be delivered to.
    (CVE-2019-18677)

  - An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests     through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The     resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content     at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no     effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing     whitespace between a header name and a colon. (CVE-2019-18678)

  - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is     vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the     raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR     protections and may aid attackers isolating memory areas to target for remote code execution attacks.
    (CVE-2019-18679)

  - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter     to cachemgr.cgi. (CVE-2019-18860)

  - An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous     function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when     opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized     error values are mapped to NULL, but later code expects that each error value is mapped to a valid error     string. (CVE-2020-14058)

  - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A     Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP     request with a Content-Length header containing +\ - or an uncommon shell whitespace character prefix     to the length field-value. (CVE-2020-15049)

  - Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all     available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when     cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply()     livelocking in peer_digest.cc mishandles EOF. (CVE-2020-24606)

  - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted     HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.
    (CVE-2020-8449)

  - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can     cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for squid fixes the following issues :

CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway (bsc#1162689).

CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).

CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).

CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).

CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).

CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).

CVE-2020-8450: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).

CVE-2020-8517: Fixed a buffer overflow in ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were discovered in the Squid proxy caching server, which could result in the bypass of security filters, information disclosure, the execution of arbitrary code or denial of service.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4743 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

    Security Fix(es):

    * squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

    * squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

    * squid: Improper input validation in URI processor (CVE-2019-12523)

    * squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

    * squid: Heap overflow issue in URN processing (CVE-2019-12526)

    * squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

    * squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

    * squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

    * squid: Buffer overflow in URI processor (CVE-2019-18676)

    * squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

    * squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

    * squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

    * squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour     (CVE-2019-18860)

    * squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

    * squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

    * squid: DoS in TLS handshake (CVE-2020-14058)

    * squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

    * squid: Improper input validation could result in a DoS (CVE-2020-24606)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
131070	SUSE SLES15セキュリティ更新プログラム：squid（SUSE-SU-2019:2975-1）	Nessus	SuSE Local Security Checks	2019/11/15	2024/4/11	critical
131386	SUSE SLES12セキュリティ更新プログラム：squid（SUSE-SU-2019:3067-1）	Nessus	SuSE Local Security Checks	2019/11/27	2024/4/9	critical
131707	Fedora 30：7: squid（2019-0b16cbdd0e）	Nessus	Fedora Local Security Checks	2019/12/5	2019/12/17	critical
131714	Fedora 31：7: squid（2019-9538783033）	Nessus	Fedora Local Security Checks	2019/12/5	2019/12/17	critical
140199	Amazon Linux 2：squid（ALAS-2020-1486）	Nessus	Amazon Linux Local Security Checks	2020/9/2	2022/5/12	high
145969	CentOS 8 : Squid：4（CESA-2020：4743)	Nessus	CentOS Local Security Checks	2021/2/1	2023/2/8	critical
132627	EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-1034)	Nessus	Huawei Local Security Checks	2020/1/2	2024/4/1	critical
149133	EulerOS 2.0 SP3 : squid (EulerOS-SA-2021-1852)	Nessus	Huawei Local Security Checks	2021/4/30	2024/1/3	critical
184691	Rocky Linux 8 : squid:4 (RLSA-2020:4743)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	critical
134561	SUSE SLES12 Security Update : squid (SUSE-SU-2020:0661-1)	Nessus	SuSE Local Security Checks	2020/3/13	2022/5/18	critical
136430	Debian DSA-4682-1 : squid - security update	Nessus	Debian Local Security Checks	2020/5/11	2024/3/13	critical
142412	RHEL 8 : squid:4 (RHSA-2020:4743)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/6/3	critical

检测

插件搜索

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical