According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow flaw was found in the way the Squid     cachemgr.cgi utility processed remotely relayed Squid     input. When the CGI interface utility is used, a remote     attacker could possibly use this flaw to execute     arbitrary code. (CVE-2016-4051)

  - Buffer overflow and input validation flaws were found     in the way Squid processed ESI responses. If Squid was     used as a reverse proxy, or for TLS/HTTPS interception,     a remote attacker able to control ESI components on an     HTTP server could use these flaws to crash Squid,     disclose parts of the stack memory, or possibly execute     arbitrary code as the user running Squid.
    (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054)

  - An input validation flaw was found in the way Squid     handled intercepted HTTP Request messages. An attacker     could use this flaw to bypass the protection against     issues related to CVE-2009-0801, and perform cache     poisoning attacks on Squid. (CVE-2016-4553)

  - An input validation flaw was found in Squid's     mime_get_header_field() function, which is used to     search for headers within HTTP requests. An attacker     could send an HTTP request from the client side with     specially crafted header Host header that bypasses     same-origin security protections, causing Squid     operating as interception or reverse-proxy to contact     the wrong origin server. It could also be used for     cache poisoning for client not following RFC 7230.
    (CVE-2016-4554)

  - A NULL pointer dereference flaw was found in the way     Squid processes ESI responses. If Squid was used as a     reverse proxy or for TLS/HTTPS interception, a     malicious server could use this flaw to crash the Squid     worker process. (CVE-2016-4555)

  - An incorrect reference counting flaw was found in the     way Squid processes ESI responses. If Squid is     configured as reverse-proxy, for TLS/HTTPS     interception, an attacker controlling a server accessed     by Squid, could crash the squid worker, causing a     Denial of Service attack. (CVE-2016-4556)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Squid security advisory 2016:5 reports :

Due to incorrect buffer management Squid cachemgr.cgi tool is vulnerable to a buffer overflow when processing remotely supplied inputs relayed to it from Squid.

This problem allows any client to seed the Squid manager reports with data that will cause a buffer overflow when processed by the cachemgr.cgi tool. However, this does require manual administrator actions to take place. Which greatly reduces the impact and possible uses.

Squid security advisory 2016:6 reports :

Due to buffer overflow issues Squid is vulnerable to a denial of service attack when processing ESI responses. Due to incorrect input validation Squid is vulnerable to public information disclosure of the server stack layout when processing ESI responses. Due to incorrect input validation and buffer overflow Squid is vulnerable to remote code execution when processing ESI responses.

These problems allow ESI components to be used to perform a denial of service attack on the Squid service and all other services on the same machine. Under certain build conditions these problems allow remote clients to view large sections of the server memory. However, the bugs are exploitable only if you have built and configured the ESI features to be used by a reverse-proxy and if the ESI components being processed by Squid can be controlled by an attacker.

An update for squid is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es) :

* A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code. (CVE-2016-4051)

* Buffer overflow and input validation flaws were found in the way Squid processed ESI responses. If Squid was used as a reverse proxy, or for TLS/ HTTPS interception, a remote attacker able to control ESI components on an HTTP server could use these flaws to crash Squid, disclose parts of the stack memory, or possibly execute arbitrary code as the user running Squid. (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054)

* An input validation flaw was found in the way Squid handled intercepted HTTP Request messages. An attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform cache poisoning attacks on Squid. (CVE-2016-4553)

* An input validation flaw was found in Squid's mime_get_header_field() function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid operating as interception or reverse-proxy to contact the wrong origin server. It could also be used for cache poisoning for client not following RFC 7230. (CVE-2016-4554)

* A NULL pointer dereference flaw was found in the way Squid processes ESI responses. If Squid was used as a reverse proxy or for TLS/HTTPS interception, a malicious server could use this flaw to crash the Squid worker process. (CVE-2016-4555)

* An incorrect reference counting flaw was found in the way Squid processes ESI responses. If Squid is configured as reverse-proxy, for TLS/HTTPS interception, an attacker controlling a server accessed by Squid, could crash the squid worker, causing a Denial of Service attack. (CVE-2016-4556)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:1140 advisory.

    The squid34 packages provide version 3.4 of Squid, a high-performance proxy caching server for web     clients, supporting FTP, Gopher, and HTTP data objects. Note that apart from squid34, this version of     Red Hat Enterprise Linux also includes the squid packages which provide Squid version 3.1.

    Security Fix(es):

    * A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed     Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to     execute arbitrary code. (CVE-2016-4051)

    * Buffer overflow and input validation flaws were found in the way Squid processed ESI responses. If Squid     was used as a reverse proxy, or for TLS/HTTPS interception, a remote attacker able to control ESI     components on an HTTP server could use these flaws to crash Squid, disclose parts of the stack memory, or     possibly execute arbitrary code as the user running Squid. (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054)

    * An input validation flaw was found in the way Squid handled intercepted HTTP Request messages. An     attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform     cache poisoning attacks on Squid. (CVE-2016-4553)

    * An input validation flaw was found in Squid's mime_get_header_field() function, which is used to search     for headers within HTTP requests. An attacker could send an HTTP request from the client side with     specially crafted header Host header that bypasses same-origin security protections, causing Squid     operating as interception or reverse-proxy to contact the wrong origin server. It could also be used for     cache poisoning for client not following RFC 7230. (CVE-2016-4554)

    * A NULL pointer dereference flaw was found in the way Squid processes ESI responses. If Squid was used as     a reverse proxy or for TLS/HTTPS interception, a malicious server could use this flaw to crash the Squid     worker process. (CVE-2016-4555)

    * An incorrect reference counting flaw was found in the way Squid processes ESI responses. If Squid is     configured as reverse-proxy, for TLS/HTTPS interception, an attacker controlling a server accessed by     Squid, could crash the squid worker, causing a Denial of Service attack. (CVE-2016-4556)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2016-1140 advisory.

    - Resolves: #1334499 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556       squid34: various flaws
    - Resolves: #1334506 - CVE-2016-4553 squid34: squid: Cache poisoning       issue in HTTP Request handling
    - Related: #1330574 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054       squid34: various flaws

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
99788	EulerOS 2.0 SP1 : squid (EulerOS-SA-2016-1025)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	high
90608	FreeBSD : squid -- multiple vulnerabilities (e05bfc92-0763-11e6-94fa-002590263bf5)	Nessus	FreeBSD Local Security Checks	2016/4/21	2021/1/4	high
91382	RHEL 7 : squid (RHSA-2016:1139)	Nessus	Red Hat Local Security Checks	2016/5/31	2019/10/24	high
91383	RHEL 6 : squid34 (RHSA-2016:1140)	Nessus	Red Hat Local Security Checks	2016/5/31	2025/4/15	high
91417	Oracle Linux 6 : squid34 (ELSA-2016-1140)	Nessus	Oracle Linux Local Security Checks	2016/6/1	2024/10/22	high
93271	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)	Nessus	SuSE Local Security Checks	2016/9/2	2026/1/27	high

検出

プラグインの検索

high

high

high

high

high

high