CVE-2016-4554MEDIUM
Description
mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue.
References
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
http://www.debian.org/security/2016/dsa-3625
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
http://www.securitytracker.com/id/1035769
http://www.squid-cache.org/Advisories/SQUID-2016_8.txt
http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID-2016_8.patch
http://www.squid-cache.org/Versions/v3/3.2/changesets/SQUID-2016_8.patch
http://www.squid-cache.org/Versions/v3/3.3/changesets/SQUID-2016_8.patch
http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-2016_8.patch
http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2016_8.patch
http://www.ubuntu.com/usn/USN-2995-1
https://access.redhat.com/errata/RHSA-2016:1138
https://access.redhat.com/errata/RHSA-2016:1139
Details
Source: MITRE
Published: 2016-05-10
Updated: 2019-12-27
Type: CWE-345
Risk Information
CVSS v2.0
Base Score: 5
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Impact Score: 2.9
Exploitability Score: 10
Severity: MEDIUM
CVSS v3.0
Base Score: 8.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Impact Score: 4
Exploitability Score: 3.9
Severity: HIGH
Vulnerable Software
Configuration 1
OR
Configuration 2
OR
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:* versions up to 3.5.17 (inclusive)
Configuration 3
OR
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 108809 | Squid < 3.5.18 Host Header Handling Same-Origin Protection / Content Filtering Bypass (SQUID-2016:8) | Nessus | Firewalls | medium |
| 99788 | EulerOS 2.0 SP1 : squid (EulerOS-SA-2016-1025) | Nessus | Huawei Local Security Checks | medium |
| 9776 | Squid 3.5.x < 3.5.18 Multiple Vulnerabilities | Nessus Network Monitor | Web Servers | medium |
| 93306 | SUSE SLES11 Security Update : squid (SUSE-SU-2016:2147-1) | Nessus | SuSE Local Security Checks | medium |
| 93294 | SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:2089-1) | Nessus | SuSE Local Security Checks | high |
| 93279 | SUSE SLES12 Security Update : squid (SUSE-SU-2016:2008-1) | Nessus | SuSE Local Security Checks | high |
| 93271 | SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1) | Nessus | SuSE Local Security Checks | high |
| 92994 | openSUSE Security Update : squid (openSUSE-2016-988) | Nessus | SuSE Local Security Checks | high |
| 92545 | Debian DLA-558-1 : squid security update | Nessus | Debian Local Security Checks | medium |
| 92525 | Debian DSA-3625-1 : squid3 - security update | Nessus | Debian Local Security Checks | medium |
| 92285 | Fedora 23 : 7:squid (2016-b3b9407940) | Nessus | Fedora Local Security Checks | high |
| 92268 | Fedora 24 : 7:squid (2016-95edf19d8a) | Nessus | Fedora Local Security Checks | high |
| 91982 | GLSA-201607-01 : Squid: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 91646 | Scientific Linux Security Update : squid on SL6.x i386/x86_64 (20160531) | Nessus | Scientific Linux Local Security Checks | medium |
| 91645 | Scientific Linux Security Update : squid34 on SL6.x i386/x86_64 (20160531) | Nessus | Scientific Linux Local Security Checks | medium |
| 91627 | Amazon Linux AMI : squid (ALAS-2016-713) | Nessus | Amazon Linux Local Security Checks | medium |
| 91558 | Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : squid3 vulnerabilities (USN-2995-1) | Nessus | Ubuntu Local Security Checks | high |
| 91513 | Scientific Linux Security Update : squid on SL7.x x86_64 (20160531) | Nessus | Scientific Linux Local Security Checks | medium |
| 91417 | Oracle Linux 6 : squid34 (ELSA-2016-1140) | Nessus | Oracle Linux Local Security Checks | medium |
| 91416 | Oracle Linux 7 : squid (ELSA-2016-1139) | Nessus | Oracle Linux Local Security Checks | medium |
| 91415 | Oracle Linux 6 : squid (ELSA-2016-1138) | Nessus | Oracle Linux Local Security Checks | medium |
| 91393 | CentOS 6 : squid34 (CESA-2016:1140) | Nessus | CentOS Local Security Checks | medium |
| 91392 | CentOS 7 : squid (CESA-2016:1139) | Nessus | CentOS Local Security Checks | medium |
| 91391 | CentOS 6 : squid (CESA-2016:1138) | Nessus | CentOS Local Security Checks | medium |
| 91383 | RHEL 6 : squid34 (RHSA-2016:1140) | Nessus | Red Hat Local Security Checks | medium |
| 91382 | RHEL 7 : squid (RHSA-2016:1139) | Nessus | Red Hat Local Security Checks | medium |
| 91381 | RHEL 6 : squid (RHSA-2016:1138) | Nessus | Red Hat Local Security Checks | medium |
| 91173 | Debian DLA-478-1 : squid3 security update | Nessus | Debian Local Security Checks | medium |
| 90980 | FreeBSD : squid -- multiple vulnerabilities (25e5205b-1447-11e6-9ead-6805ca0b3d42) | Nessus | FreeBSD Local Security Checks | medium |