Squid Proxy < 2.5.STABLE8 Gopher, WCCP, and Cache Poisoning Vulnerabilities

high Log Correlation Engine Plugin ID 801039

Synopsis

The remote host is missing a critical security patch or upgrade.

Description

The remote Squid caching proxy, according to its version number, is vulnerable to several security flaws :

- There is a buffer overflow issue when handling the reply of a rogue gopher site. To exploit this issue, an attacker would need to use the remote proxy to visit a specially setup gopher site generating malformed replies

- There is a denial of service vulnerability in the WCCP code of the remote proxy. To exploit this flaw, an attacker would need to guess the IP of the WCCP router used by the proxy and spoof a malformed UDP packet using the router IP address. There are several flaws in the way that the Squid proxy caches pages.
An attacker exploiting these flaws would be able to poison the Squid
cache.

Solution

Upgrade to Squid 2.5.STABLE8 or higher.

See Also

http://.squid-cache.org/Versions/v2/2.5/bugs

Plugin Details

Severity: High

ID: 801039

Family: Web Servers

Nessus ID: 16190

Risk Information

CVSS v2

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.4

Vector: CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:P

Reference Information

CVE: CVE-2005-0094, CVE-2005-0095, CVE-2005-0173, CVE-2005-0174, CVE-2005-0175, CVE-2005-0211, CVE-2005-0241

BID: 12276, 12412, 12431, 12432, 12433, 12275, 13434, 13435