Squid 3.x < 3.5.15 / 4.x < 4.0.7 Multiple DoS

This script is Copyright (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote proxy server is potentially affected by multiple denial of
service vulnerabilities.

Description :

According to its banner, the version of Squid running on the remote
host is 3.x prior to 3.5.15 or 4.x prior to 4.0.7. It is, therefore,
potentially affected by multiple denial of service vulnerabilities :

- A flaw exists due to not properly appending data to
String objects. A remote attacker can exploit this, via
a crafted HTTP Vary header, to cause an assertion
failure and daemon exit, resulting in a denial of
service. (CVE-2016-2569)

- A flaw exists in the Edge Side Includes (ESI) parser due
to a failure to check buffer limits during XML parsing.
A remote attacker can exploit this, via a crafted XML
document, to cause an assertion failure and daemon exit,
resulting in a denial of service. (CVE-2016-2570)

- A flaw exists in http.cc that allows the storage of
certain data even after a response-parsing failure. A
remote attacker can exploit this, via a malformed
server response, to cause an assertion failure and
daemon exit, resulting in a denial of service.
CVE-2016-2571)

- A flaw exists in http.cc due to reliance on the HTTP
status code even after a response-parsing failure. A
remote attacker can exploit this, via a malformed
server response, to cause an assertion failure and
daemon exit, resulting in a denial of service.
(CVE-2016-2572)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.
Furthermore, the patch released to address these issues does not
update the version given in the banner. If the patch has been applied
properly, and the service has been restarted, then consider this to be
a false positive.

See also :

http://www.squid-cache.org/Advisories/
http://www.squid-cache.org/Advisories/SQUID-2016_2.txt

Solution :

Upgrade to Squid version 3.5.15 / 4.0.7 or later. Alternatively, apply
the vendor-supplied patch.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS Temporal Score : 6.4
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: Firewalls

Nessus Plugin ID: 89080 ()

Bugtraq ID:

CVE ID: CVE-2016-2569
CVE-2016-2570
CVE-2016-2571
CVE-2016-2572

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now