Squid 2.5 STABLE9 and earlier, when the DNS client port is unfiltered and the environment does not prevent IP spoofing, allows remote attackers to spoof DNS lookups.

An updated squid package that fixes several security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Squid is a full-featured Web proxy cache.

A race condition bug was found in the way Squid handles the now obsolete Set-Cookie header. It is possible that Squid can leak Set-Cookie header information to other clients connecting to Squid.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0626 to this issue. Please note that this issue only affected Red Hat Enterprise Linux 4.

A bug was found in the way Squid handles PUT and POST requests. It is possible for an authorised remote user to cause a failed PUT or POST request which can cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0718 to this issue.

A bug was found in the way Squid processes errors in the access control list. It is possible that an error in the access control list could give users more access than intended. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1345 to this issue.

A bug was found in the way Squid handles access to the cachemgr.cgi script. It is possible for an authorised remote user to bypass access control lists with this flaw. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-0710 to this issue.

A bug was found in the way Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1519 to this issue.

Additionally this update fixes the following bugs: - LDAP Authentication fails with an assertion error when using Red Hat Enterprise Linux 4

Users of Squid should upgrade to this updated package, which contains backported patches to correct these issues.

It was discovered that Squid did not verify the validity of DNS server responses. When Squid is started, it opens a DNS client UDP port whose number is randomly assigned by the operating system. Unless your network firewall is configured to accept DNS responses only from known good nameservers, this vulnerability allowed users within the local network to inject arbitrary DNS responses into Squid ('DNS spoofing').
This could be used to present different web pages to users from those they actually requested.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The squid patches page notes :

Malicious users may spoof DNS lookups if the DNS client UDP port (random, assigned by OS as startup) is unfiltered and your network is not protected from IP spoofing.

The upstream developers have discovered a bug in the DNS lookup code of Squid, the popular WWW proxy cache. When the DNS client UDP port (assigned by the operating system at startup) is unfiltered and the network is not protected from IP spoofing, malicious users can spoof DNS lookups which could result in users being redirected to arbitrary web sites.

A bug was found in the way that Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall, it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:415 advisory.

  - security flaw (CVE-1999-0710, CVE-2005-0626, CVE-2005-0718, CVE-2005-1345, CVE-2005-1519)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An updated squid package that fixes several security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Squid is a full-featured Web proxy cache.

A bug was found in the way Squid handles PUT and POST requests. It is possible for an authorised remote user to cause a failed PUT or POST request which can cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0718 to this issue.

A bug was found in the way Squid handles access to the cachemgr.cgi script. It is possible for an authorised remote user to bypass access control lists with this flaw. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-0710 to this issue.

A bug was found in the way Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall, it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1519 to this issue.

Additionally, this update fixes the following bugs: - squid fails in the unpacking of squid-2.4.STABLE7-1.21as.5.src.rpm

Users of Squid should upgrade to this updated package, which contains backported patches to correct these issues.

- Mon May 16 2005 Jay Fenlason <fenlason at redhat.com>     7:2.5.STABLE9-1.FC3.6

  - More upstream patches, including ones for bz#157456     CVE-2005-1519 DNS lookups unreliable on untrusted     networks bz#156162 CVE-1999-0710 cachemgr.cgi access     control bypass

  - The following bugs had already been fixed, but the     announcements were lost bz#156711 CVE-2005-1390 HTTP     Request Smuggling Vulnerabilities bz#156703     CVE-2005-1389 HTTP Response Splitting Vulnerabilities     (Both fixed by squid-7:2.5.STABLE8-1.FC3.1) bz#151419     Unexpected access control results on configuration     errors (Fixed by 7:2.5.STABLE9-1.FC3.2)     bz#152647#squid-2.5.STABLE9-1.FC3.4.x86_64.rpm is broken     (fixed by 7:2.5.STABLE9-1.FC3.5) bz#141938 squid ldap     authentification broken (Fixed by 7:2.5.STABLE7-1.FC3)

  - Fri Apr 1 2005 Jay Fenlason <fenlason at redhat.com>     7:2.5.STABLE9-1.FC3.5

  - More upstream patches, including a new version of the
    -2GB patch that doesn't break diskd.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Squid caching proxy, according to its version number, is vulnerable to an attack where the attacker gains access to Set-Cookie headers for another user.  Such an attack would allow the attacker to gain access to resources with the credentials of another user.  

The remote Squid caching proxy, according to its version number,
is vulnerable to an attack where the attacker gains access to Set-Cookie headers for another user.  Such an attack would allow the attacker to gain access to resources with the credentials of another user.

ID	Name	Product	Family	Severity
21822	CentOS 3 / 4 : squid (CESA-2005:415)	Nessus	CentOS Local Security Checks	high
20519	Ubuntu 4.10 / 5.04 : squid vulnerability (USN-129-1)	Nessus	Ubuntu Local Security Checks	medium
19000	FreeBSD : squid -- DNS lookup spoofing vulnerability (7e97b288-c7ca-11d9-9e1e-c296ac722cb3)	Nessus	FreeBSD Local Security Checks	medium
18667	Debian DSA-751-1 : squid - IP spoofing	Nessus	Debian Local Security Checks	medium
18561	Mandrake Linux Security Advisory : squid (MDKSA-2005:104)	Nessus	Mandriva Local Security Checks	medium
18500	RHEL 4 : squid (RHSA-2005:415)	Nessus	Red Hat Local Security Checks	high
18471	RHEL 2.1 : squid (RHSA-2005:489)	Nessus	Red Hat Local Security Checks	high
18337	Fedora Core 3 : squid-2.5.STABLE9-1.FC3.6 (2005-373)	Nessus	Fedora Local Security Checks	high
2669	Squid < 2.5.STABLE10 Set-Cookie Authentication Information Disclosure	Nessus Network Monitor	Web Servers	medium
801035	Squid < 2.5.STABLE10 Set-Cookie Authentication Information Disclosure	Log Correlation Engine	Web Servers	low

Detections

Analytics

CVE-2005-1519

high

Tenable Plugins

high

medium

medium

medium

medium

high

high

high

medium

low