The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-905:02 advisory.

    Squid is a high-performance proxy caching server for Web clients,     supporting FTP, gopher, and HTTP data objects. Unlike traditional     caching software, Squid handles all requests in a single,     non-blocking, I/O-driven process. Squid keeps meta data and especially     hot objects cached in RAM, caches DNS lookups, supports non-blocking     DNS lookups, and implements negative caching of failed requests.
    Squid consists of a main server program squid, a Domain Name System     lookup program (dnsserver), a program for retrieving FTP data     (ftpget), and some management and client tools.
    Security issues fixed with this release:
    CVE-2016-2569     Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append     data to String objects, which allows remote servers to cause a denial     of service (assertion failure and daemon exit) via a long string, as     demonstrated by a crafted HTTP Vary header.
    CVE-2016-2570     The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x     before 4.0.7 does not check buffer limits during XML parsing, which     allows remote HTTP servers to cause a denial of service (assertion     failure and daemon exit) via a crafted XML document, related to     esi/CustomParser.cc and esi/CustomParser.h.
    CVE-2016-2571     http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with     the storage of certain data after a response-parsing failure, which     allows remote HTTP servers to cause a denial of service (assertion     failure and daemon exit) via a malformed response.
    CVE-2016-2572     http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after     a response-parsing failure, which allows remote HTTP servers to cause     a denial of service (assertion failure and daemon exit) via a     malformed response.
    CVE-2016-3948     Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds     checking, which allows remote attackers to cause a denial of service     via a crafted HTTP response, related to Vary headers.
    The following packages have been upgraded to a newer upstream version: squid (3.5.20).
    Additional Changes:

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer     limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion     failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and     esi/CustomParser.h. (CVE-2016-2570)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3557-1 advisory.

    Mathias Fischer discovered that Squid incorrectly handled certain long strings in headers. A malicious     remote server could possibly cause Squid to crash, resulting in a denial of service. This issue was only     addressed in Ubuntu 16.04 LTS. (CVE-2016-2569)

    William Lima discovered that Squid incorrectly handled XML parsing when processing Edge Side Includes     (ESI). A malicious remote server could possibly cause Squid to crash, resulting in a denial of service.
    This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2016-2570)

    Alex Rousskov discovered that Squid incorrectly handled response-parsing failures. A malicious remote     server could possibly cause Squid to crash, resulting in a denial of service. This issue only applied to     Ubuntu 16.04 LTS. (CVE-2016-2571)

    Santiago Ruano Rincn discovered that Squid incorrectly handled certain Vary headers. A remote attacker     could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue was     only addressed in Ubuntu 16.04 LTS. (CVE-2016-3948)

    Louis Dion-Marcil discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A     malicious remote server could possibly cause Squid to crash, resulting in a denial of service.
    (CVE-2018-1000024)

    Louis Dion-Marcil discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A     malicious remote server could possibly cause Squid to crash, resulting in a denial of service.
    (CVE-2018-1000027)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not     properly append data to String objects, which allows     remote servers to cause a denial of service (assertion     failure and daemon exit) via a long string, as     demonstrated by a crafted HTTP Vary     header.(CVE-2016-2569)

  - The Edge Side Includes (ESI) parser in Squid 3.x before     3.5.15 and 4.x before 4.0.7 does not check buffer     limits during XML parsing, which allows remote HTTP     servers to cause a denial of service (assertion failure     and daemon exit) via a crafted XML document, related to     esi/CustomParser.cc and     esi/CustomParser.h.(CVE-2016-2570)

  - http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7     proceeds with the storage of certain data after a     response-parsing failure, which allows remote HTTP     servers to cause a denial of service (assertion failure     and daemon exit) via a malformed     response.(CVE-2016-2571)

  - http.cc in Squid 4.x before 4.0.7 relies on the HTTP     status code after a response-parsing failure, which     allows remote HTTP servers to cause a denial of service     (assertion failure and daemon exit) via a malformed     response.(CVE-2016-2572)

  - Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly     perform bounds checking, which allows remote attackers     to cause a denial of service via a crafted HTTP     response, related to Vary headers.(CVE-2016-3948)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following packages have been upgraded to a newer upstream version:
squid (3.5.20).

Security Fix(es) :

  - Incorrect boundary checks were found in the way squid     handled headers in HTTP responses, which could lead to     an assertion failure. A malicious HTTP server could use     this flaw to crash squid using a specially crafted HTTP     response. (CVE-2016-2569, CVE-2016-2570)

  - It was found that squid did not properly handle errors     when failing to parse an HTTP response, possibly leading     to an assertion failure. A malicious HTTP server could     use this flaw to crash squid using a specially crafted     HTTP response. (CVE-2016-2571, CVE-2016-2572)

  - An incorrect boundary check was found in the way squid     handled the Vary header in HTTP responses, which could     lead to an assertion failure. A malicious HTTP server     could use this flaw to crash squid using a specially     crafted HTTP response. (CVE-2016-3948)

Additional Changes :

An update for squid is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a newer upstream version:
squid (3.5.20). (BZ#1273942, BZ#1349775)

Security Fix(es) :

* Incorrect boundary checks were found in the way squid handled headers in HTTP responses, which could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response. (CVE-2016-2569, CVE-2016-2570)

* It was found that squid did not properly handle errors when failing to parse an HTTP response, possibly leading to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response. (CVE-2016-2571, CVE-2016-2572)

* An incorrect boundary check was found in the way squid handled the Vary header in HTTP responses, which could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response. (CVE-2016-3948)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Versions of Squid 3.5.x prior to 3.5.15 are affected by multiple vulnerabilities :

 - A flaw is triggered when performing improper bounds checks on specially crafted HTTP responses. This may allow a remote attacker to cause a denial of service. 
 - A flaw is triggered as bounds are not properly checked when processing HTTP responses. This may allow a remote attacker to cause a denial of service for all clients accessing the service.
 - An overflow condition exists in the 'Icmp6::Recv()' function in 'icmp/Icmp6.cc' of the pinger binary. The issue is triggered as user-supplied input is not properly validated when handling specially crafted ICMPv6 packets. This may allow a remote attacker to cause a buffer overflow, crashing the pinger process or potentially leaking data into log files.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2600 advisory.

    - Resolves: #1322770 - CVE-2016-2569 CVE-2016-2570 CVE-2016-2571 CVE-2016-2572       CVE-2016-3948 squid: various flaws
    - Related: #1334509 - CVE-2016-4553 squid: Cache poisoning issue in       HTTP Request handling
    - Related: #1334492 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556       squid: various flaws
    - Related: #1330577 - CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 squid: multiple       issues in ESI processing
    - Related: #1330577 - CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 squid: multiple       issues in ESI processing

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2600 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    The following packages have been upgraded to a newer upstream version: squid (3.5.20). (BZ#1273942,     BZ#1349775)

    Security Fix(es):

    * Incorrect boundary checks were found in the way squid handled headers in HTTP responses, which could     lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially     crafted HTTP response. (CVE-2016-2569, CVE-2016-2570)

    * It was found that squid did not properly handle errors when failing to parse an HTTP response, possibly     leading to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a     specially crafted HTTP response. (CVE-2016-2571, CVE-2016-2572)

    * An incorrect boundary check was found in the way squid handled the Vary header in HTTP responses, which     could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a     specially crafted HTTP response. (CVE-2016-3948)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - Regression caused by the DoS fixes above (bsc#993299)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues :

  - Fixed multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2015-5400: Improper protection of alternate path.
    (bsc#938715)

  - CVE-2015-3455: Squid http proxy configured with     client-first SSL bumping did not correctly validate     server certificate. (bsc#929493)

  - CVE-2016-3948: Fixed denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: Fixed     multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4553: Fixed cache poisoning issue in HTTP     Request handling (bsc#979009)

  - CVE-2016-4554: Fixed header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fixed multiple Denial of Service issues in ESI Response     processing. (CVE-2016-4555, CVE-2016-4556, bsc#979011,     bsc#979008)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues :

  - Fixed multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2015-5400: Improper protection of alternate path.
    (bsc#938715)

  - CVE-2015-3455: Squid http proxy configured with     client-first SSL bumping did not correctly validate     server certificate. (bsc#929493)

  - CVE-2016-3948: Fixed denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: Fixed     multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4553: Fixed cache poisoning issue in HTTP     Request handling (bsc#979009)

  - CVE-2016-4554: Fixed header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fixed multiple Denial of Service issues in ESI Response     processing. (CVE-2016-4555, CVE-2016-4556, bsc#979011,     bsc#979008)

Additionally, the following non-security issues have been fixed :

  - Fix header size in script unsquid.pl. (bsc#902197)

  - Add external helper ext_session_acl to package.
    (bsc#959290)

  - Update forward_max_tries to permit 25 server paths With     cloud sites becoming more popular more CDN servers are     producing long lists of IPv6 and IPv4 addresses. If     there are not enough paths selected the IPv4 ones may     never be reached.

  - squid.init: wait that squid really dies when we kill it     on upgrade instead of proclaiming its demise prematurely     (bnc#963539)

This update was imported from the SUSE:SLE-12:Update update project.

Security fix for CVE-2016-4553, CVE-2016-4554, CVE-2016-4555, CVE-2016-4556

----

Security fix for CVE-2016-4051, CVE-2016-4052, CVE-2016-4053, CVE-2016-4054

----

Security fix for CVE-2016-3947 and CVE-2016-3948

----

Security fix for CVE-2016-2569 CVE-2016-2570 CVE-2016-2571 CVE-2016-2572

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201607-01 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.5.15 or 4.x prior to 4.0.7. It is, therefore, potentially affected by multiple denial of service vulnerabilities :

  - A flaw exists due to not properly appending data to     String objects. A remote attacker can exploit this, via     a crafted HTTP Vary header, to cause an assertion     failure and daemon exit, resulting in a denial of     service. (CVE-2016-2569)

  - A flaw exists in the Edge Side Includes (ESI) parser due     to a failure to check buffer limits during XML parsing.
    A remote attacker can exploit this, via a crafted XML     document, to cause an assertion failure and daemon exit,     resulting in a denial of service. (CVE-2016-2570)

  - A flaw exists in http.cc that allows the storage of     certain data even after a response-parsing failure. A     remote attacker can exploit this, via a malformed     server response, to cause an assertion failure and     daemon exit, resulting in a denial of service.
    CVE-2016-2571)

  - A flaw exists in http.cc due to reliance on the HTTP     status code even after a response-parsing failure. A     remote attacker can exploit this, via a malformed     server response, to cause an assertion failure and     daemon exit, resulting in a denial of service.
    (CVE-2016-2572)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Furthermore, the patch released to address these issues does not update the version given in the banner. If the patch has been applied properly, and the service has been restarted, then consider this to be a false positive.

Squid security advisory 2016:2 reports :

Due to incorrect bounds checking Squid is vulnerable to a denial of service attack when processing HTTP responses.

These problems allow remote servers delivering certain unusual HTTP response syntax to trigger a denial of service for all clients accessing the Squid service.

HTTP responses containing malformed headers that trigger this issue are becoming common. We are not certain at this time if that is a sign of malware or just broken server scripting.

ID	Name	Product	Family	Type	Severity
291556	MiracleLinux 7 : squid-3.5.20-2.el7 (AXSA:2016-905:02)	Nessus	Miracle Linux Local Security Checks	Local	high
219361	Linux Distros Unpatched Vulnerability : CVE-2016-2570	Nessus	Misc.	Local	high
106619	Ubuntu 14.04 LTS / 16.04 LTS : Squid vulnerabilities (USN-3557-1)	Nessus	Ubuntu Local Security Checks	Local	high
99818	EulerOS 2.0 SP1 : squid (EulerOS-SA-2016-1056)	Nessus	Huawei Local Security Checks	Local	high
95860	Scientific Linux Security Update : squid on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	Local	high
95346	CentOS 7 : squid (CESA-2016:2600)	Nessus	CentOS Local Security Checks	Local	high
9774	Squid 3.5.x < 3.5.15 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		medium
94719	Oracle Linux 7 : squid (ELSA-2016-2600)	Nessus	Oracle Linux Local Security Checks	Local	high
94563	RHEL 7 : squid (RHSA-2016:2600)	Nessus	Red Hat Local Security Checks	Local	high
93294	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:2089-1)	Nessus	SuSE Local Security Checks	Local	high
93279	SUSE SLES12 Security Update : squid (SUSE-SU-2016:2008-1)	Nessus	SuSE Local Security Checks	Local	high
93271	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)	Nessus	SuSE Local Security Checks	Local	high
92994	openSUSE Security Update : squid (openSUSE-2016-988)	Nessus	SuSE Local Security Checks	Local	high
92285	Fedora 23 : 7:squid (2016-b3b9407940)	Nessus	Fedora Local Security Checks	Local	high
91982	GLSA-201607-01 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
89080	Squid 3.x < 3.5.15 / 4.x < 4.0.7 Multiple DoS	Nessus	Firewalls	Remote	high
88944	FreeBSD : squid -- remote DoS in HTTP response processing (660ebbf5-daeb-11e5-b2bd-002590263bf5)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2016-2570

high

Tenable Plugins

high

high

high

high

high

high

medium

high

high

high

high

high

high

high

high

high

high