HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."

CVE-2014-3609: Denial of Service in Range header processing.

Ignore Range headers with unidentifiable byte-range values. If squid is unable to determine the byte value for ranges, treat the header as invalid.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated squid packages fix security vulnerabilities :

Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing certain HTTPS requests if the SSL-Bump feature is enabled (CVE-2014-0128).

Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service (CVE-2014-3609).

Due to incorrect buffer management Squid can be caused by an attacker to write outside its allocated SNMP buffer (CVE-2014-6270).

Due to incorrect bounds checking Squid pinger binary is vulnerable to denial of service or information leak attack when processing larger than normal ICMP or ICMPv6 packets (CVE-2014-7141).

Due to incorrect input validation Squid pinger binary is vulnerable to denial of service or information leak attacks when processing ICMP or ICMPv6 packets (CVE-2014-7142).

Matthew Daley discovered that squid, a web proxy cache, does not properly perform input validation when parsing requests. A remote attacker could use this flaw to mount a denial of service attack, by sending specially crafted Range requests.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. (CVE-2014-0128)

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.3.13 or 3.4.7. It is, therefore, affected by a denial of service vulnerability.

The flaw exists due to user-supplied input not being properly validated in request parsing. This allows a remote attacker to specially craft a request with Range headers with unidentifiable byte-range values to crash the application.

Note that Nessus has relied only on the version in the proxy server's banner. The patch released to address the issue does not update the version in the banner. If the patch has been applied properly, and the service has been restarted, consider this to be a false positive.

Security fix for CVE-2014-3609

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues and bugs with squid :

A denial of Service in Range header processing was fixed that could be used by proxy users to crash squid. (CVE-2014-3609)

Also the following bugs were fixed :

  - bnc#894840: removed unnecessary 'sharedscripts' in     squid's logrotate snippet

  - bnc#894636: fixes run of init script when logrotate is     called

Squid3 was updated to fix a denial of service in Range Header processing, which would have allowed proxy users to crash the squid proxy process. (CVE-2014-3609)

Updated squid packages fix security vulnerability :

Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service (CVE-2014-3609).

Squid versions prior to 3.3.13 and 3.4.7 are potentially affected by a denial of service vulnerability due to an error in the 'src/HttpHdrRange.cc' file.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

After installing this update, the squid service will be restarted automatically.

An updated squid package that fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

Red Hat would like to thank the Squid project for reporting the CVE-2014-3609 issue. Upstream acknowledges Matthew Daley as the original reporter.

All Squid users are advised to upgrade to this updated package, which contains backported patches to correct these issues. After installing this update, the squid service will be restarted automatically.

Updated squid packages that fix one security issue are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

Red Hat would like to thank the Squid project for reporting this issue. Upstream acknowledges Matthew Daley as the original reporter.

All Squid users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically.

From Red Hat Security Advisory 2014:1148 :

An updated squid package that fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

Red Hat would like to thank the Squid project for reporting the CVE-2014-3609 issue. Upstream acknowledges Matthew Daley as the original reporter.

All Squid users are advised to upgrade to this updated package, which contains backported patches to correct these issues. After installing this update, the squid service will be restarted automatically.

From Red Hat Security Advisory 2014:1147 :

Updated squid packages that fix one security issue are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

Red Hat would like to thank the Squid project for reporting this issue. Upstream acknowledges Matthew Daley as the original reporter.

All Squid users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically.

Matthew Daley discovered that Squid3, a fully featured web proxy cache, did not properly perform input validation in request parsing. A remote attacker could use this flaw to mount a denial of service by sending crafted Range requests.

Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
83168	Debian DLA-216-1 : squid security update	Nessus	Debian Local Security Checks	medium
82356	Mandriva Linux Security Advisory : squid (MDVSA-2015:103)	Nessus	Mandriva Local Security Checks	medium
82192	Debian DLA-45-1 : squid3 security update	Nessus	Debian Local Security Checks	medium
81006	Debian DSA-3139-1 : squid - security update	Nessus	Debian Local Security Checks	medium
78658	Amazon Linux AMI : squid (ALAS-2014-433)	Nessus	Amazon Linux Local Security Checks	high
78354	Amazon Linux AMI : squid (ALAS-2014-411)	Nessus	Amazon Linux Local Security Checks	high
77985	Squid 3.x < 3.3.13 / 3.4.7 Request Processing DoS	Nessus	Firewalls	medium
77799	Fedora 21 : squid-3.4.7-1.fc21 (2014-9882)	Nessus	Fedora Local Security Checks	medium
77777	openSUSE Security Update : squid (openSUSE-SU-2014:1144-1)	Nessus	SuSE Local Security Checks	medium
77743	SuSE 11.3 Security Update : squid3 (SAT Patch Number 9729)	Nessus	SuSE Local Security Checks	medium
77656	Mandriva Linux Security Advisory : squid (MDVSA-2014:177)	Nessus	Mandriva Local Security Checks	medium
8384	Squid 3.3.x < 3.3.13 / 3.4.x < 3.4.7 Request Parsing Vulnerability	Nessus Network Monitor	Web Servers	medium
77617	Fedora 19 : squid-3.3.13-1.fc19 (2014-9963)	Nessus	Fedora Local Security Checks	medium
77559	Fedora 20 : squid-3.3.13-1.fc20 (2014-9948)	Nessus	Fedora Local Security Checks	medium
77553	Scientific Linux Security Update : squid on SL5.x, SL6.x i386/x86_64 (20140903)	Nessus	Scientific Linux Local Security Checks	high
77523	RHEL 5 / 6 : squid (RHSA-2014:1148)	Nessus	Red Hat Local Security Checks	high
77522	RHEL 7 : squid (RHSA-2014:1147)	Nessus	Red Hat Local Security Checks	medium
77517	Oracle Linux 5 / 6 : squid (ELSA-2014-1148)	Nessus	Oracle Linux Local Security Checks	high
77516	Oracle Linux 7 : squid (ELSA-2014-1147)	Nessus	Oracle Linux Local Security Checks	medium
77509	CentOS 5 / 6 : squid (CESA-2014:1148)	Nessus	CentOS Local Security Checks	high
77508	CentOS 7 : squid (CESA-2014:1147)	Nessus	CentOS Local Security Checks	medium
77422	Debian DSA-3014-1 : squid3 - security update	Nessus	Debian Local Security Checks	medium
77420	Ubuntu 14.04 LTS : Squid 3 vulnerability (USN-2327-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2014-3609

high

Tenable Plugins

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium

high

medium

high

medium

medium

high