Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.

The version of squid installed on the remote host is prior to 3.5.20-17.48. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1766 advisory.

  - Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through     4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being     suitable for delivery to multiple clients. (CVE-2016-10003)

  - An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication     credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with     memory access protections, this can result in the helper process being terminated unexpectedly. This leads     to the Squid process also terminating and a denial of service for all clients using the proxy.
    (CVE-2020-8517)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2066 advisory.

  - Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through     4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being     suitable for delivery to multiple clients. (CVE-2016-10003)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Incorrect HTTP Request header comparison in Squid HTTP     Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16     results in Collapsed Forwarding feature mistakenly     identifying some private responses as being suitable     for delivery to multiple clients.(CVE-2016-10003)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Squid before 4.4 has XSS via a crafted X.509     certificate during HTTP(S) error page generation for     certificate errors.(CVE-2018-19131)

  - Squid before 4.4, when SNMP is enabled, allows a denial     of service (Memory Leak) via an SNMP     packet.(CVE-2018-19132)

  - Incorrect HTTP Request header comparison in Squid HTTP     Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16     results in Collapsed Forwarding feature mistakenly     identifying some private responses as being suitable     for delivery to multiple clients.(CVE-2016-10003)

  - An issue was discovered in Squid 3.3.9 through 3.5.28     and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header     Proxy-Authorization. It searches for certain tokens     such as domain, uri, and qop. Squid checks if this     token's value starts with a quote and ends with one. If     so, it performs a memcpy of its length minus 2. Squid     never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a     memcpy of its length minus 1.(CVE-2019-12525)

  - The cachemgr.cgi web module of Squid through 4.7 has     XSS via the user_name or auth     parameter.(CVE-2019-13345)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Incorrect HTTP Request header comparison in Squid HTTP     Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16     results in Collapsed Forwarding feature mistakenly     identifying some private responses as being suitable     for delivery to multiple clients.(CVE-2016-10003)

  - Squid before 4.4 has XSS via a crafted X.509     certificate during HTTP(S) error page generation for     certificate errors.(CVE-2018-19131)

  - Squid before 4.4, when SNMP is enabled, allows a denial     of service (Memory Leak) via an SNMP     packet.(CVE-2018-19132)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.5.23, or 4.x prior to 4.0.17. It is, therefore, affected by an information disclosure vulnerability in the collapsed forwarding feature due to the incorrect comparison of request headers. An unauthenticated, remote attacker can exploit this to disclose potentially sensitive information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Saulius Lapinskas discovered that Squid incorrectly handled processing HTTP conditional requests. A remote attacker could possibly use this issue to obtain sensitive information related to other clients' browsing sessions. (CVE-2016-10002)

Felix Hassert discovered that Squid incorrectly handled certain HTTP Request headers when using the Collapsed Forwarding feature. A remote attacker could possibly use this issue to obtain sensitive information related to other clients' browsing sessions. This issue only applied to Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-10003).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-10002, CVE-2016-10003

----

Version update and bugfix of #1392476

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid fixes the following issues :

  - CVE-2016-10003: Prevent incorrect forwarding of cached     private responses when Collapsed Forwarding feature is     enabled. This allowed remote attacker (proxy user) to     discover private and sensitive information about another     user (bsc#1016169).

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168).

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for squid fixes the following issues :

  - CVE-2016-10003: Prevent incorrect forwarding of cached     private responses when Collapsed Forwarding feature is     enabled. This allowed remote attacker (proxy user) to     discover private and sensitive information about another     user (bsc#1016169).

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168).

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Squid 4.0.x prior to 4.0.17, and 3.5.x prior to 3.5.18 are affected by multiple vulnerabilities :

 - A flaw exists in the collapsed forwarding functionality in 'client_side_reply.cc' that is triggered as request headers are not properly compared, which can cause the program to deliver responses containing private data to clients it should not have reached.  This may allow a remote attacker to gain access to potentially sensitive information from other sessions.
 - A flaw exists in 'client_side_reply.cc' that is triggered during the handling of HTTP conditional requests.  This may allow a remote attacker to gain access to potentially sensitive information from other sessions. 

Squid security advisory 2016:10 reports :

Due to incorrect comparison of request headers Squid can deliver responses containing private data to clients it should not have reached.

This problem allows a remote attacker to discover private and sensitive information about another clients browsing session.
Potentially including credentials which allow access to further sensitive resources. This problem only affects Squid configured to use the Collapsed Forwarding feature. It is of particular importance for HTTPS reverse-proxy sites with Collapsed Forwarding.

Squid security advisory 2016:11 reports :

Due to incorrect HTTP conditional request handling Squid can deliver responses containing private data to clients it should not have reached.

This problem allows a remote attacker to discover private and sensitive information about another clients browsing session.
Potentially including credentials which allow access to further sensitive resources..

ID	Name	Product	Family	Severity
177070	Amazon Linux AMI : squid (ALAS-2023-1766)	Nessus	Amazon Linux Local Security Checks	high
176678	Amazon Linux 2 : squid (ALAS-2023-2066)	Nessus	Amazon Linux Local Security Checks	high
132201	EulerOS 2.0 SP3 : squid (EulerOS-SA-2019-2666)	Nessus	Huawei Local Security Checks	high
131599	EulerOS 2.0 SP2 : squid (EulerOS-SA-2019-2445)	Nessus	Huawei Local Security Checks	critical
130693	EulerOS 2.0 SP5 : squid (EulerOS-SA-2019-2231)	Nessus	Huawei Local Security Checks	high
100617	Squid 3.5.x < 3.5.23 / 4.x < 4.0.17 Information Disclosure Vulnerability (SQUID-2016:10)	Nessus	Firewalls	high
97049	Ubuntu 14.04 LTS / 16.04 LTS : Squid vulnerabilities (USN-3192-1)	Nessus	Ubuntu Local Security Checks	high
96670	Fedora 25 : 7:squid (2016-c614315d29)	Nessus	Fedora Local Security Checks	high
96622	openSUSE Security Update : squid (openSUSE-2017-115)	Nessus	SuSE Local Security Checks	high
96530	SUSE SLES12 Security Update : squid (SUSE-SU-2017:0128-1)	Nessus	SuSE Local Security Checks	high
9858	Squid 3.5.x < 3.5.23 / 4.0.x < 4.0.17 Multiple Information Disclosure	Nessus Network Monitor	Web Servers	low
96117	FreeBSD : squid -- multiple vulnerabilities (41f8af15-c8b9-11e6-ae1b-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-10003

high

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

low

high