Squid 2.x / 3.x < 3.1.23 / 3.2.6 / cachemgr.cgi DoS

This script is Copyright (C) 2013-2014 Tenable Network Security, Inc.

Synopsis :

The remote proxy server is affected by a denial of service

Description :

According to its banner, the version of Squid running on the remote
host is 2.x or 3.x prior to 3.1.23 / 3.2.6 / The included
'cachemgr.cgi' tool reportedly lacks input validation, which could be
abused by any client able to access that tool to perform a denial of
service attack on the service host.

Note this fix is a result of an incomplete fix for CVE-2012-5643.

Further note that Nessus did not actually test for this issue, but
instead has relied on the version in the server's banner.

See also :


Solution :

Either upgrade to Squid version 3.1.23 / 3.2.6 / or later, or
apply the vendor-supplied patch.

Alternatively, restrict access to this CGI or limit CGI memory
consumption via the host web server's configuration options.

Risk factor :

Medium / CVSS Base Score : 4.3
CVSS Temporal Score : 3.7
Public Exploit Available : false

Family: Firewalls

Nessus Plugin ID: 64501 ()

Bugtraq ID: 56957

CVE ID: CVE-2012-5643