Several vulnerabilities have been discovered in Squid3, a fully featured web proxy cache. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2018-1000024     Louis Dion-Marcil discovered that Squid does not     properly handle processing of certain ESI responses. A     remote server delivering certain ESI response syntax can     take advantage of this flaw to cause a denial of service     for all clients accessing the Squid service. This     problem is limited to the Squid custom ESI parser.

  - CVE-2018-1000027     Louis Dion-Marcil discovered that Squid is prone to a     denial of service vulnerability when processing ESI     responses or downloading intermediate CA certificates. A     remote attacker can take advantage of this flaw to cause     a denial of service for all clients accessing the Squid     service.

This update for squid3 fixes the following issues: Security issues fixed :

  - CVE-2018-1000024: DoS fix caused by incorrect pointer     handling when processing ESI responses. This affects the     default custom esi_parser (bsc#1077003).

  - CVE-2018-1000027: DoS fix caused by incorrect pointer     handing whien processing ESI responses or downloading     intermediate CA certificates (bsc#1077006).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1068 advisory.

    - Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter       in cachemgr.cgi
    - Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has squid packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid     calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's     being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a     new member to the stack. When adding a new member, there is no check to ensure that the stack won't     overflow. (CVE-2019-12519)

  - An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest     Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the     attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if     the pooled token credentials are freed (instead of replayed as valid credentials). (CVE-2020-11945)

  - The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a     Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service     for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP     response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed     in 4.0.23 and later. (CVE-2018-1000024)

  - The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL     Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in     Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server     responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to     have been fixed in 4.0.23 and later. (CVE-2018-1000027)

  - An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as     domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it     performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a memcpy of its length minus 1. (CVE-2019-12525)

  - The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
    (CVE-2019-13345)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 版本 3.0 至 3.5.27、4.0 至 4.0.22 的 Squid Software Foundation Squid HTTP Caching Proxy 在 ESI Response Processing 中包含不正确的指针处理漏洞， 可导致使用此代理的所有客户端拒绝服务。此攻击似乎可通过远程服务器交付包含有效但异常的 ESI 语法的 HTTP 响应有效负载加以利用。此漏洞似乎已在 4.0.23 或更高版本中修复。(CVE-2018-1000024)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

在功能齐全的 web 代理缓存 Squid3 中发现数个漏洞。Common Vulnerabilities and Exposures 计划发现以下问题：- CVE-2018-1000024 Louis Dion-Marcil 发现 Squid 未正确处理某些 ESI 响应。提供某些 ESI 响应语法的远程服务器可利用此缺陷，对所有访问 Squid 服务的客户端造成拒绝服务。此问题仅限 Squid 自定义 ESI 解析器。- CVE-2018-1000027 Louis Dion-Marcil 发现 Squid 在处理 ESI 响应或下载中间 CA 证书时容易出现拒绝服务漏洞。远程攻击者可利用此缺陷，对所有访问 Squid 服务的客户端造成拒绝服务。

远程 Oracle Linux 7 主机上安装的多个程序包受到 ELSA-2020-1068 公告中提及的多个漏洞影响。

  - 版本 3.0 至 3.5.27、4.0 至 4.0.22 的 Squid Software Foundation Squid HTTP Caching Proxy 在 ESI Response Processing 中包含不正确的指针处理漏洞， 可导致使用此代理的所有客户端拒绝服务。此攻击似乎可通过远程服务器交付包含有效但异常的 ESI 语法的 HTTP 响应有效负载加以利用。此漏洞似乎已在 4.0.23 或更高版本中修复。(CVE-2018-1000024)

  在 Squid 4.7 及之前的版本中，cachemgr.cgi web 模块中存在通过 user_name 或 auth 参数造成的 XSS 漏洞。
    (CVE-2019-13345)

  - 4.0.23 版本之前的 Squid Software Foundation Squid HTTP Caching Proxy 在 HTTP Response X-Forwarded-For 标头中包含空指针取消引用漏洞，可导致向此代理的所有客户端拒绝服务。通过远程 HTTP 服务器以 X-Forwarded-For 标头响应某些类型的 HTTP 请求，似乎可以利用此攻击。此漏洞似乎已在 4.0.23 或更高版本中修复。(CVE-2018-1000027)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

运行 CORE 5.05/MAIN 5.05 版本的远程 NewStart CGSL 主机上安装的 squid 程序包受到多个漏洞的影响：

  - 在 Squid 4.7 及之前的版本中发现问题。- 处理标记 esi 时：如果已启用 ESI，则 Squid 会调用 ESIExpression: : Evaluate。在对表达式求值时，此函数使用固定堆栈缓冲区保留该表达式。在处理表达式时，它可以对栈顶求值，也可以向堆栈中添加新成员。在添加新成员时，未进行检查以确保堆栈不会溢出。(CVE-2019-12519)

  - 在 Squid 5.0.2 之前的版本中发现问题。远程攻击者可重播嗅探到的摘要式身份验证 nonce，以访问本来被禁止的资源。发生此问题的原因在于攻击者可使 nonce 引用计数器（短整数）溢出。如果系统释放了池化的令牌凭据（而不是作为有效凭据重播），则可能会发生远程代码执行。(CVE-2020-11945)

  - 版本 3.0 至 3.5.27、4.0 至 4.0.22 的 Squid Software Foundation Squid HTTP Caching Proxy 在 ESI Response Processing 中包含不正确的指针处理漏洞， 可导致使用此代理的所有客户端拒绝服务。此攻击似乎可通过远程服务器交付包含有效但异常的 ESI 语法的 HTTP 响应有效负载加以利用。此漏洞似乎已在 4.0.23 或更高版本中修复。(CVE-2018-1000024)

  - 4.0.23 版本之前的 Squid Software Foundation Squid HTTP Caching Proxy 在 HTTP Response X-Forwarded-For 标头中包含空指针取消引用漏洞，可导致向此代理的所有客户端拒绝服务。通过远程 HTTP 服务器以 X-Forwarded-For 标头响应某些类型的 HTTP 请求，似乎可以利用此攻击。此漏洞似乎已在 4.0.23 或更高版本中修复。(CVE-2018-1000027)

  - 在 Squid 3.3.9 至 3.5.28 及 4.x 至 4.7 版本中发现问题。当 Squid 配置为使用摘要式认证时，它会解析标头 Proxy-Authorization。它会搜寻特定标记，例如域、uri 和 qop。Squid 会检查此标记的值开头是否为引号，且结尾是否为 1。如果是，则它会对其长度减 2 执行 memcpy。Squid 始终不检查该值是否仅为单引号（将满足其要求），从而导致对其长度减 1 执行 memcpy。(CVE-2019-12525)

  在 Squid 4.7 及之前的版本中，cachemgr.cgi web 模块中存在通过 user_name 或 auth 参数造成的 XSS 漏洞。
    (CVE-2019-13345)

请注意，Nessus 尚未测试此问题，而是只依赖于应用程序自我报告的版本号。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
106957	Debian DSA-4122-1 : squid3 - security update	Nessus	Debian Local Security Checks	2018/2/23	2018/11/13	high
108528	SUSE SLES11 Security Update : squid3 (SUSE-SU-2018:0752-1)	Nessus	SuSE Local Security Checks	2018/3/22	2024/12/19	high
180752	Oracle Linux 7 : squid (ELSA-2020-1068)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	medium
143989	NewStart CGSL CORE 5.05 / MAIN 5.05 : squid Multiple Vulnerabilities (NS-SA-2020-0090)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2024/2/5	critical
221329	Linux Distros 未修补的漏洞: CVE-2018-1000024	Nessus	Misc.	2025/3/4	2025/3/4	high
106957	Debian DSA-4122-1：squid3 - 安全更新	Nessus	Debian Local Security Checks	2018/2/23	2018/11/13	high
180752	Oracle Linux 7：squid (ELSA-2020-1068)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	medium
143989	NewStart CGSL CORE 5.05 / MAIN 5.05：squid 多个漏洞 (NS-SA-2020-0090)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2024/2/5	critical

検出

プラグインの検索

high

high

medium

critical

high

high

medium

critical