__________________________________________________________________ Squid Proxy Cache Security Update Advisory SQUID-2016:4 __________________________________________________________________ Advisory ID: SQUID-2016:4 Date: April 02, 2016 Summary: Denial of Service issue in HTTP Response processing. Affected versions: Squid 3.x -> 3.5.15 Squid 4.x -> 4.0.7 Fixed in version: Squid 4.0.8, 3.5.16 __________________________________________________________________ http://www.squid-cache.org/Advisories/SQUID-2016_4.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3948 __________________________________________________________________ Problem Description: Due to incorrect bounds checking Squid is vulnerable to a denial of service attack when processing HTTP responses. __________________________________________________________________ Severity: This problem allows a malicious client script and remote server delivering certain unusual HTTP response syntax to trigger a denial of service for all clients accessing the Squid service. __________________________________________________________________ Updated Packages: This bug is fixed by Squid version 3.5.16 and 4.0.8. In addition, a patch addressing this problem for the stable release can be found in our patch archives: Squid 3.5: http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14016.patch If you are using a prepackaged version of Squid then please refer to the package vendor for availability information on updated packages. __________________________________________________________________ Determining if your version is vulnerable: All unpatched Squid-3.0 versions are vulnerable. All unpatched Squid-3.1 versions are vulnerable. All unpatched Squid-3.2 versions are vulnerable. All unpatched Squid-3.3 versions are vulnerable. All unpatched Squid-3.4 versions are vulnerable. All unpatched Squid-3.5 up to and including Squid-3.5.15 are vulnerable. All unpatched Squid-4.0 up to and including 4.0.7 are vulnerable. __________________________________________________________________ Workaround: There are no good workarounds known for this vulnerability. The following squid.conf settings can protect Squid-3.5 (only): acl Vary rep_header Vary . store_miss deny Vary Or, The following squid.conf setting can protect Squid-3.0 or later: cache deny all __________________________________________________________________ Contact details for the Squid project: For installation / upgrade support on binary packaged versions of Squid: Your first point of contact should be your binary package vendor. If your install and build Squid from the original Squid sources then the squid-users@lists.squid-cache.org mailing list is your primary support point. For subscription details see . For reporting of non-security bugs in the latest STABLE release the squid bugzilla database should be used . For reporting of security sensitive bugs send an email to the squid-bugs@lists.squid-cache.org mailing list. It's a closed list (though anyone can post) and security related bug reports are treated in confidence until the impact has been established. __________________________________________________________________ Credits: This vulnerability was reported by Santiago Ruano Rincón from Debian. Fixed by Amos Jeffries from Treehouse Networks Ltd. __________________________________________________________________ Revision history: 2016-03-20 11:25:04 UTC Initial Report 2016-04-01 06:15:31 UTC Patch Released __________________________________________________________________ END