Squid 2.x / 3.x < 3.1.23 / 3.2.6 / 3.3.0.3 cachemgr.cgi DoS

Medium Nessus Plugin ID 64501

Synopsis

The remote proxy server is affected by a denial of service vulnerability.

Description

According to its banner, the version of Squid running on the remote host is 2.x or 3.x prior to 3.1.23 / 3.2.6 / 3.3.0.3. The included 'cachemgr.cgi' tool reportedly lacks input validation, which could be abused by any client able to access that tool to perform a denial of service attack on the service host.

Note this fix is a result of an incomplete fix for CVE-2012-5643.
Further note that Nessus did not actually test for this issue, but instead has relied on the version in the server's banner.

Solution

Either upgrade to Squid version 3.1.23 / 3.2.6 / 3.3.0.3 or later, or apply the vendor-supplied patch.

Alternatively, restrict access to this CGI or limit CGI memory consumption via the host web server's configuration options.

See Also

http://www.squid-cache.org/Advisories/SQUID-2012_1.txt

Plugin Details

Severity: Medium

ID: 64501

File Name: squid_3_2_6.nasl

Version: 1.9

Type: remote

Family: Firewalls

Published: 2013/02/08

Updated: 2018/09/17

Dependencies: 49692

Configuration: Enable paranoid mode

Risk Information

Risk Factor: Medium

CVSS Score Source: CVE-2013-0189

CVSS v2.0

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:squid-cache:squid

Required KB Items: www/squid, Settings/ParanoidReport

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2013/01/01

Vulnerability Publication Date: 2012/12/17

Reference Information

CVE: CVE-2012-5643, CVE-2013-0189

BID: 56957, 57646