Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-4051.

Versions of Squid 3.5.x prior to 3.5.17 are affected by multiple vulnerabilities :

 - A flaw in 'esi/Esi.cc' is triggered as input is not properly validated when handling ESI responses. This may allow a remote attacker to disclose the server stack layout.
 - An overflow condition in 'esi/Esi.cc' is triggered as user-supplied input is not properly validated when handling ESI responses. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - An assertion flaw in 'esi/Esi.cc' is triggered as input is not properly validated when handling ESI responses. This may allow a remote attacker to terminate the service.
 - An overflow condition is triggered as user-supplied input is not properly validated when processing the length of content lines in reports by the 'cachemgr.cgi' tool. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.

A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code. (CVE-2016-4051)

It was found that the fix for CVE-2016-4051 did not properly prevent the stack overflow in the munge_other_line() function. A remote attacker could send specially crafted data to the Squid proxy, which would exploit the cachemgr CGI utility, possibly triggering execution of arbitrary code. (CVE-2016-5408)

Security Fix(es) :

  - It was found that the fix for CVE-2016-4051 released via     SLSA-2016:1138 did not properly prevent the stack     overflow in the munge_other_line() function. A remote     attacker could send specially crafted data to the Squid     proxy, which would exploit the cachemgr CGI utility,     possibly triggering execution of arbitrary code.
    (CVE-2016-5408)

An update for squid is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es) :

* It was found that the fix for CVE-2016-4051 released via RHSA-2016:1138 did not properly prevent the stack overflow in the munge_other_line() function. A remote attacker could send specially crafted data to the Squid proxy, which would exploit the cachemgr CGI utility, possibly triggering execution of arbitrary code.
(CVE-2016-5408)

Red Hat would like to thank Amos Jeffries (Squid) for reporting this issue.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2016-1573 advisory.

    [7:3.1.23-16.6]
    - Resolves: #1359204 - CVE-2016-5408 squid: Buffer overflow vulnerability       in cachemgr.cgi tool

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
9775	Squid 3.5.x < 3.5.17 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
93013	Amazon Linux AMI : squid (ALAS-2016-735)	Nessus	Amazon Linux Local Security Checks	critical
92749	Scientific Linux Security Update : squid on SL6.x i386/x86_64 (20160804)	Nessus	Scientific Linux Local Security Checks	critical
92748	RHEL 6 : squid (RHSA-2016:1573)	Nessus	Red Hat Local Security Checks	critical
92747	Oracle Linux 6 : squid (ELSA-2016-1573)	Nessus	Oracle Linux Local Security Checks	critical
92726	CentOS 6 : squid (CESA-2016:1573)	Nessus	CentOS Local Security Checks	critical

Detections

Analytics

CVE-2016-5408

critical

Tenable Plugins

medium

critical

critical

critical

critical

critical