The Squid package in Red Hat Linux 5.2 and 6.0, and other distributions, installs cachemgr.cgi in a public web directory, which allows remote attackers to use it as an intermediary to connect to other systems.

An updated squid package that fixes several security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Squid is a full-featured Web proxy cache.

A race condition bug was found in the way Squid handles the now obsolete Set-Cookie header. It is possible that Squid can leak Set-Cookie header information to other clients connecting to Squid.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0626 to this issue. Please note that this issue only affected Red Hat Enterprise Linux 4.

A bug was found in the way Squid handles PUT and POST requests. It is possible for an authorised remote user to cause a failed PUT or POST request which can cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0718 to this issue.

A bug was found in the way Squid processes errors in the access control list. It is possible that an error in the access control list could give users more access than intended. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1345 to this issue.

A bug was found in the way Squid handles access to the cachemgr.cgi script. It is possible for an authorised remote user to bypass access control lists with this flaw. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-0710 to this issue.

A bug was found in the way Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1519 to this issue.

Additionally this update fixes the following bugs: - LDAP Authentication fails with an assertion error when using Red Hat Enterprise Linux 4

Users of Squid should upgrade to this updated package, which contains backported patches to correct these issues.

The squid patches page notes :

This patch adds access controls to the cachemgr.cgi script, preventing it from being abused to reach other servers than allowed in a local configuration file.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:415 advisory.

    Squid is a full-featured Web proxy cache.

    A race condition bug was found in the way Squid handles the now obsolete     Set-Cookie header. It is possible that Squid can leak Set-Cookie header     information to other clients connecting to Squid. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2005-0626 to this issue. Please note that this issue only affected Red     Hat Enterprise Linux 4.

    A bug was found in the way Squid handles PUT and POST requests. It is     possible for an authorised remote user to cause a failed PUT or POST     request which can cause Squid to crash. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0718 to     this issue.

    A bug was found in the way Squid processes errors in the access control     list. It is possible that an error in the access control list could give     users more access than intended. The Common Vulnerabilities and Exposures     project (cve.mitre.org) has assigned the name CAN-2005-1345 to this issue.

    A bug was found in the way Squid handles access to the cachemgr.cgi script.
    It is possible for an authorised remote user to bypass access control     lists with this flaw. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CVE-1999-0710 to this issue.

    A bug was found in the way Squid handles DNS replies.  If the port Squid     uses for DNS requests is not protected by a firewall it is possible for a     remote attacker to spoof DNS replies, possibly redirecting a user to     spoofed or malicious content. The Common Vulnerabilities and Exposures     project (cve.mitre.org) has assigned the name CAN-2005-1519 to this issue.

    Additionally this update fixes the following bugs:
     - LDAP Authentication fails with an assertion error when using Red Hat     Enterprise Linux 4

    Users of Squid should upgrade to this updated package, which contains     backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An updated squid package that fixes several security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Squid is a full-featured Web proxy cache.

A bug was found in the way Squid handles PUT and POST requests. It is possible for an authorised remote user to cause a failed PUT or POST request which can cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0718 to this issue.

A bug was found in the way Squid handles access to the cachemgr.cgi script. It is possible for an authorised remote user to bypass access control lists with this flaw. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-0710 to this issue.

A bug was found in the way Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall, it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1519 to this issue.

Additionally, this update fixes the following bugs: - squid fails in the unpacking of squid-2.4.STABLE7-1.21as.5.src.rpm

Users of Squid should upgrade to this updated package, which contains backported patches to correct these issues.

- Mon May 16 2005 Jay Fenlason <fenlason at redhat.com>     7:2.5.STABLE9-1.FC3.6

  - More upstream patches, including ones for bz#157456     CVE-2005-1519 DNS lookups unreliable on untrusted     networks bz#156162 CVE-1999-0710 cachemgr.cgi access     control bypass

  - The following bugs had already been fixed, but the     announcements were lost bz#156711 CVE-2005-1390 HTTP     Request Smuggling Vulnerabilities bz#156703     CVE-2005-1389 HTTP Response Splitting Vulnerabilities     (Both fixed by squid-7:2.5.STABLE8-1.FC3.1) bz#151419     Unexpected access control results on configuration     errors (Fixed by 7:2.5.STABLE9-1.FC3.2)     bz#152647#squid-2.5.STABLE9-1.FC3.4.x86_64.rpm is broken     (fixed by 7:2.5.STABLE9-1.FC3.5) bz#141938 squid ldap     authentification broken (Fixed by 7:2.5.STABLE7-1.FC3)

  - Fri Apr 1 2005 Jay Fenlason <fenlason at redhat.com>     7:2.5.STABLE9-1.FC3.5

  - More upstream patches, including a new version of the
    -2GB patch that doesn't break diskd.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security vulnerabilities have been discovered in Squid, the internet object cache, the popular WWW proxy cache. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-1999-0710     It is possible to bypass access lists and scan arbitrary     hosts and ports in the network through cachemgr.cgi,     which is installed by default. This update disables this     feature and introduces a configuration file     (/etc/squid/cachemgr.conf) to control this behavior.

  - CAN-2004-0918

    The asn_parse_header function (asn1.c) in the SNMP     module for Squid allows remote attackers to cause a     denial of service via certain SNMP packets with negative     length fields that causes a memory allocation error.

RedHat Linux 6.0 installs by default a squid cache manager cgi script with no restricted access permissions. This script could be used to perform a port scan from the cgi-host machine.

ID	Name	Product	Family	Severity
21822	CentOS 3 / 4 : squid (CESA-2005:415)	Nessus	CentOS Local Security Checks	high
19055	FreeBSD : squid -- possible abuse of cachemgr.cgi (a395397c-c7c8-11d9-9e1e-c296ac722cb3)	Nessus	FreeBSD Local Security Checks	high
18500	RHEL 4 : squid (RHSA-2005:415)	Nessus	Red Hat Local Security Checks	high
18471	RHEL 2.1 : squid (RHSA-2005:489)	Nessus	Red Hat Local Security Checks	high
18337	Fedora Core 3 : squid-2.5.STABLE9-1.FC3.6 (2005-373)	Nessus	Fedora Local Security Checks	high
15674	Debian DSA-576-1 : squid - several vulnerabilities	Nessus	Debian Local Security Checks	high
10034	Squid cachemgr.cgi Proxied Port Scanning	Nessus	CGI abuses	high

Detections

Analytics

CVE-1999-0710

critical

Tenable Plugins

high

high

high

high

high

high

high