Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through     4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being     suitable for delivery to multiple clients. (CVE-2016-10003)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10
    through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data
    being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this
    information. (CVE-2016-10002)

  - Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through
    4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being
    suitable for delivery to multiple clients. (CVE-2016-10003)

The version of squid installed on the remote host is prior to 3.5.20-17.48. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1766 advisory.

    Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through     4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being     suitable for delivery to multiple clients. (CVE-2016-10003)

    An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication     credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with     memory access protections, this can result in the helper process being terminated unexpectedly. This leads     to the Squid process also terminating and a denial of service for all clients using the proxy.
    (CVE-2020-8517)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2066 advisory.

    Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through     4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being     suitable for delivery to multiple clients. (CVE-2016-10003)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Incorrect HTTP Request header comparison in Squid HTTP     Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16     results in Collapsed Forwarding feature mistakenly     identifying some private responses as being suitable     for delivery to multiple clients.(CVE-2016-10003)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Squid before 4.4 has XSS via a crafted X.509     certificate during HTTP(S) error page generation for     certificate errors.(CVE-2018-19131)

  - Squid before 4.4, when SNMP is enabled, allows a denial     of service (Memory Leak) via an SNMP     packet.(CVE-2018-19132)

  - Incorrect HTTP Request header comparison in Squid HTTP     Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16     results in Collapsed Forwarding feature mistakenly     identifying some private responses as being suitable     for delivery to multiple clients.(CVE-2016-10003)

  - An issue was discovered in Squid 3.3.9 through 3.5.28     and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header     Proxy-Authorization. It searches for certain tokens     such as domain, uri, and qop. Squid checks if this     token's value starts with a quote and ends with one. If     so, it performs a memcpy of its length minus 2. Squid     never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a     memcpy of its length minus 1.(CVE-2019-12525)

  - The cachemgr.cgi web module of Squid through 4.7 has     XSS via the user_name or auth     parameter.(CVE-2019-13345)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Incorrect HTTP Request header comparison in Squid HTTP     Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16     results in Collapsed Forwarding feature mistakenly     identifying some private responses as being suitable     for delivery to multiple clients.(CVE-2016-10003)

  - Squid before 4.4 has XSS via a crafted X.509     certificate during HTTP(S) error page generation for     certificate errors.(CVE-2018-19131)

  - Squid before 4.4, when SNMP is enabled, allows a denial     of service (Memory Leak) via an SNMP     packet.(CVE-2018-19132)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.5.23, or 4.x prior to 4.0.17. It is, therefore, affected by an information disclosure vulnerability in the collapsed forwarding feature due to the incorrect comparison of request headers. An unauthenticated, remote attacker can exploit this to disclose potentially sensitive information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3192-1 advisory.

    Saulius Lapinskas discovered that Squid incorrectly handled processing HTTP conditional requests. A remote     attacker could possibly use this issue to obtain sensitive information related to other clients' browsing     sessions. (CVE-2016-10002)

    Felix Hassert discovered that Squid incorrectly handled certain HTTP Request headers when using the     Collapsed Forwarding feature. A remote attacker could possibly use this issue to obtain sensitive     information related to other clients' browsing sessions. This issue only applied to Ubuntu 16.04 LTS and     Ubuntu 16.10. (CVE-2016-10003)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2016-10002, CVE-2016-10003

----

Version update and bugfix of #1392476

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid fixes the following issues :

  - CVE-2016-10003: Prevent incorrect forwarding of cached     private responses when Collapsed Forwarding feature is     enabled. This allowed remote attacker (proxy user) to     discover private and sensitive information about another     user (bsc#1016169).

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168).

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for squid fixes the following issues :

  - CVE-2016-10003: Prevent incorrect forwarding of cached     private responses when Collapsed Forwarding feature is     enabled. This allowed remote attacker (proxy user) to     discover private and sensitive information about another     user (bsc#1016169).

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168).

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Squid 4.0.x prior to 4.0.17, and 3.5.x prior to 3.5.18 are affected by multiple vulnerabilities :

 - A flaw exists in the collapsed forwarding functionality in 'client_side_reply.cc' that is triggered as request headers are not properly compared, which can cause the program to deliver responses containing private data to clients it should not have reached.  This may allow a remote attacker to gain access to potentially sensitive information from other sessions.
 - A flaw exists in 'client_side_reply.cc' that is triggered during the handling of HTTP conditional requests.  This may allow a remote attacker to gain access to potentially sensitive information from other sessions. 

Squid security advisory 2016:10 reports :

Due to incorrect comparison of request headers Squid can deliver responses containing private data to clients it should not have reached.

This problem allows a remote attacker to discover private and sensitive information about another clients browsing session.
Potentially including credentials which allow access to further sensitive resources. This problem only affects Squid configured to use the Collapsed Forwarding feature. It is of particular importance for HTTPS reverse-proxy sites with Collapsed Forwarding.

Squid security advisory 2016:11 reports :

Due to incorrect HTTP conditional request handling Squid can deliver responses containing private data to clients it should not have reached.

This problem allows a remote attacker to discover private and sensitive information about another clients browsing session.
Potentially including credentials which allow access to further sensitive resources..

ID	Name	Product	Family	Type	Severity
219222	Linux Distros Unpatched Vulnerability : CVE-2016-10003	Nessus	Misc.	Local	high
407221	Alpine: squid: security update to 3.5.23-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
407221	Alpine: squid: security update to 3.5.23-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
177070	Amazon Linux AMI : squid (ALAS-2023-1766)	Nessus	Amazon Linux Local Security Checks	Local	high
176678	Amazon Linux 2 : squid (ALAS-2023-2066)	Nessus	Amazon Linux Local Security Checks	Local	high
132201	EulerOS 2.0 SP3 : squid (EulerOS-SA-2019-2666)	Nessus	Huawei Local Security Checks	Local	high
131599	EulerOS 2.0 SP2 : squid (EulerOS-SA-2019-2445)	Nessus	Huawei Local Security Checks	Local	critical
130693	EulerOS 2.0 SP5 : squid (EulerOS-SA-2019-2231)	Nessus	Huawei Local Security Checks	Local	high
100617	Squid 3.5.x < 3.5.23 / 4.x < 4.0.17 Information Disclosure Vulnerability (SQUID-2016:10)	Nessus	Firewalls	Remote	high
97049	Ubuntu 14.04 LTS / 16.04 LTS : Squid vulnerabilities (USN-3192-1)	Nessus	Ubuntu Local Security Checks	Local	high
96670	Fedora 25 : 7:squid (2016-c614315d29)	Nessus	Fedora Local Security Checks	Local	high
96622	openSUSE Security Update : squid (openSUSE-2017-115)	Nessus	SuSE Local Security Checks	Local	high
96530	SUSE SLES12 Security Update : squid (SUSE-SU-2017:0128-1)	Nessus	SuSE Local Security Checks	Local	high
9858	Squid 3.5.x < 3.5.23 / 4.0.x < 4.0.17 Multiple Information Disclosure	Nessus Network Monitor	Web Servers		low
96117	FreeBSD : squid -- multiple vulnerabilities (41f8af15-c8b9-11e6-ae1b-002590263bf5)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2016-10003

high

Tenable Plugins

high

high

high

high

high

high

critical

high

high

high

high

high

high

low

high