Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote     authenticated users to retain access by leveraging a stale nonce, aka Nonce replay vulnerability.
    (CVE-2014-9749)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for squid fixes the following issues :

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168)

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942)

This update was imported from the SUSE:SLE-12:Update update project.

This update for squid fixes the following issues :

  - CVE-2016-10003: Prevent incorrect forwarding of cached     private responses when Collapsed Forwarding feature is     enabled. This allowed remote attacker (proxy user) to     discover private and sensitive information about another     user (bsc#1016169).

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168).

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for squid fixes the following issues :

  - CVE-2016-10003: Prevent incorrect forwarding of cached     private responses when Collapsed Forwarding feature is     enabled. This allowed remote attacker (proxy user) to     discover private and sensitive information about another     user (bsc#1016169).

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168).

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid fixes the following issues :

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168)

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168)

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

squid was updated to fix two security issues.

These security issues were fixed :

  - CVE-2014-6270: Fixed an off by one in snmp subsystem     (bsc#895773).

  - CVE-2014-9749: Fixed a nonce replay vulnerability in     Digest authentication (bsc#949942).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

squid was updated to fix one security issue.

This security issue was fixed :

  - CVE-2014-9749: Nonce replay vulnerability in Digest     authentication (bsc#949942).

ID	Name	Product	Family	Severity
218493	Linux Distros Unpatched Vulnerability : CVE-2014-9749	Nessus	Misc.	critical
96648	openSUSE Security Update : squid (openSUSE-2017-127)	Nessus	SuSE Local Security Checks	high
96622	openSUSE Security Update : squid (openSUSE-2017-115)	Nessus	SuSE Local Security Checks	high
96530	SUSE SLES12 Security Update : squid (SUSE-SU-2017:0128-1)	Nessus	SuSE Local Security Checks	high
96482	SUSE SLES12 Security Update : squid (SUSE-SU-2017:0116-1)	Nessus	SuSE Local Security Checks	high
96432	SUSE SLES11 Security Update : squid3 (SUSE-SU-2017:0110-1)	Nessus	SuSE Local Security Checks	high
86883	SUSE SLES11 Security Update : squid (SUSE-SU-2015:1983-1)	Nessus	SuSE Local Security Checks	medium
86647	openSUSE Security Update : squid (openSUSE-2015-684)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2014-9749

critical

Tenable Plugins

critical

high

high

high

high

high

medium

medium