Squid 2.x / 3.x < 3.1.23 / 3.2.6 / 3.3.0.3 cachemgr.cgi DoS

This script is Copyright (C) 2013-2014 Tenable Network Security, Inc.


Synopsis :

The remote proxy server is affected by a denial of service
vulnerability.

Description :

According to its banner, the version of Squid running on the remote
host is 2.x or 3.x prior to 3.1.23 / 3.2.6 / 3.3.0.3. The included
'cachemgr.cgi' tool reportedly lacks input validation, which could be
abused by any client able to access that tool to perform a denial of
service attack on the service host.

Note this fix is a result of an incomplete fix for CVE-2012-5643.

Further note that Nessus did not actually test for this issue, but
instead has relied on the version in the server's banner.

See also :

http://www.squid-cache.org/Advisories/SQUID-2012_1.txt

Solution :

Either upgrade to Squid version 3.1.23 / 3.2.6 / 3.3.0.3 or later, or
apply the vendor-supplied patch.

Alternatively, restrict access to this CGI or limit CGI memory
consumption via the host web server's configuration options.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 3.7
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: Firewalls

Nessus Plugin ID: 64501 ()

Bugtraq ID: 56957
57646

CVE ID: CVE-2012-5643
CVE-2013-0189