Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - Regression caused by the DoS fixes above (bsc#993299)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201607-01 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

Sebastian Krahmer discovered that Squid incorrectly handled certain SNMP requests. If SNMP is enabled, a remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-6270)

Alex Rousskov discovered that Squid incorrectly handled certain malformed responses. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service.
(CVE-2016-2571).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

squid was updated to fix two security issues.

These security issues were fixed :

  - CVE-2014-6270: Fixed an off by one in snmp subsystem     (bsc#895773).

  - CVE-2014-9749: Fixed a nonce replay vulnerability in     Digest authentication (bsc#949942).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This squid updated fixes the following security update.

  - bnc#895773: fix off-by-one in snmp subsystem     (CVE-2014-6270)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated squid packages fix security vulnerabilities :

Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing certain HTTPS requests if the SSL-Bump feature is enabled (CVE-2014-0128).

Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service (CVE-2014-3609).

Due to incorrect buffer management Squid can be caused by an attacker to write outside its allocated SNMP buffer (CVE-2014-6270).

Due to incorrect bounds checking Squid pinger binary is vulnerable to denial of service or information leak attack when processing larger than normal ICMP or ICMPv6 packets (CVE-2014-7141).

Due to incorrect input validation Squid pinger binary is vulnerable to denial of service or information leak attacks when processing ICMP or ICMPv6 packets (CVE-2014-7142).

Versions of Squid 3.4.x prior to 3.4.8 are potentially affected by by the following vulnerabilities :

  - An off-by-one overflow flaw exists within the SNMP processing component. By using a specially crafted UDP SNMP request, a remote attacker could exploit this to cause a denial of service or possibly execute arbitrary code. (CVE-2014-6270)

  - There exists an array indexing flaw in the node pinger that is triggered when parsing ICMP and ICMPv6 replies, which may allow a remote attacker to crash the pinger or obtain sensitive information. (CVE-2014-7141)

  - The node pinger has a flaw in function 'Icmp4::Recv' in file 'icmp/Icmp4.cc' that is triggered when parsing ICMP or ICMPv6 responses. A remote attacker could exploit this to crash the pinger or obtain sensitive information. (CVE-2014-7142)

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.4.8. Therefore, it may be affected by the following vulnerabilities :

  - A off-by-one overflow flaw exists within the SNMP     processing component. By using a specially crafted     UDP SNMP request, a remote attacker could exploit this     to cause a denial of service or possibly execute     arbitrary code. (CVE-2014-6270)

  - There exists an array indexing flaw in the node pinger     that is triggered when parsing ICMP and ICMPv6 replies,     which may allow a remote attacker to crash the pinger or     obtain sensitive information. (CVE-2014-7141)

  - The node pinger has a flaw in function 'Icmp4::Recv' in     file 'icmp/Icmp4.cc.' that is triggered when parsing     ICMP or ICMPv6 responses. A remote attacker could     exploit this to crash the pinger or obtain sensitive     information. (CVE-2014-7142)

Note that Nessus has relied only on the version in the proxy server's banner. The patch released to address the issue does not update the version in the banner. If the patch has been applied properly, and the service has been restarted, consider this to be a false positive.

This updated fixes CVE-2014-6270.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The squid-cache project reports :

Due to incorrect buffer management Squid can be caused by an attacker to write outside its allocated SNMP buffer.

ID	Name	Product	Family	Severity
93294	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:2089-1)	Nessus	SuSE Local Security Checks	high
93271	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)	Nessus	SuSE Local Security Checks	high
91982	GLSA-201607-01 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
89734	Ubuntu 14.04 LTS : Squid vulnerabilities (USN-2921-1)	Nessus	Ubuntu Local Security Checks	high
86883	SUSE SLES11 Security Update : squid (SUSE-SU-2015:1983-1)	Nessus	SuSE Local Security Checks	medium
83662	SUSE SLES12 Security Update : squid (SUSE-SU-2015:0028-1)	Nessus	SuSE Local Security Checks	medium
82356	Mandriva Linux Security Advisory : squid (MDVSA-2015:103)	Nessus	Mandriva Local Security Checks	medium
8634	Squid 3.x < 3.4.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
79742	Squid 3.x < 3.4.8 Multiple Vulnerabilities	Nessus	Firewalls	medium
78400	Fedora 19 : squid-3.3.13-2.fc19 (2014-10794)	Nessus	Fedora Local Security Checks	medium
78399	Fedora 20 : squid-3.3.13-2.fc20 (2014-10790)	Nessus	Fedora Local Security Checks	medium
78398	Fedora 21 : squid-3.4.7-2.fc21 (2014-10767)	Nessus	Fedora Local Security Checks	medium
77753	FreeBSD : squid -- Buffer overflow in SNMP processing (d3324c55-3f11-11e4-ad16-001999f8d30b)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-6270

critical

Tenable Plugins

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium