Squid 2.x / 3.x < 3.1.23 / 3.2.6 / 220.127.116.11 cachemgr.cgi DoS
Medium Nessus Plugin ID 64501
SynopsisThe remote proxy server is affected by a denial of service vulnerability.
DescriptionAccording to its banner, the version of Squid running on the remote host is 2.x or 3.x prior to 3.1.23 / 3.2.6 / 18.104.22.168. The included 'cachemgr.cgi' tool reportedly lacks input validation, which could be abused by any client able to access that tool to perform a denial of service attack on the service host.
Note this fix is a result of an incomplete fix for CVE-2012-5643.
Further note that Nessus did not actually test for this issue, but instead has relied on the version in the server's banner.
SolutionEither upgrade to Squid version 3.1.23 / 3.2.6 / 22.214.171.124 or later, or apply the vendor-supplied patch.
Alternatively, restrict access to this CGI or limit CGI memory consumption via the host web server's configuration options.