__________________________________________________________________ Squid Proxy Cache Security Update Advisory SQUID-2016:9 __________________________________________________________________ Advisory ID: SQUID-2016:9 Date: May 06, 2016 Summary: Multiple Denial of Service issues in ESI Response processing. Affected versions: Squid 3.x -> 3.5.17 Squid 4.x -> 4.0.9 Fixed in version: Squid 4.0.10, 3.5.18 __________________________________________________________________ http://www.squid-cache.org/Advisories/SQUID-2016_9.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4555 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4556 __________________________________________________________________ Problem Description: Due to incorrect pointer handling and reference counting Squid is vulnerable to a denial of service attack when processing ESI responses. __________________________________________________________________ Severity: These problems allow a remote server delivering certain ESI response syntax to trigger a denial of service for all clients accessing the Squid service. Due to unrelated changes Squid-3.5 has become vulnerable to some regular ESI server responses also triggering one or more of these issues. __________________________________________________________________ Updated Packages: This bug is fixed by Squid version 3.5.18 and 4.0.10. In addition, patches addressing this problem for the stable releases can be found in our patch archives: Squid 3.4: Squid 3.5: If you are using a prepackaged version of Squid then please refer to the package vendor for availability information on updated packages. __________________________________________________________________ Determining if your version is vulnerable: All Squid-2.x are not vulnerable. All Squid built with --disable-esi are not vulnerable. All Squid-3.0 versions built without --enable-esi are not vulnerable. All Squid-3.0 versions built with --enable-esi and used for reverse-proxy are vulnerable to the CVE-2016-4556 problem. All Squid-3.1 are not vulnerable to the CVE-2016-4555 problem. All Squid-3.1 and later versions up to and including Squid-3.5.17 being used for reverse-proxy are vulnerable to both problems. All Squid-3.1 and later versions up to and including Squid-3.5.17 being used for TLS / HTTPS interception are vulnerable to both problems. All unpatched Squid-4.0 up to and including Squid-4.0.9 being used as reverse-proxy are vulnerable to both problems. All unpatched Squid-4.0 up to and including Squid-4.0.9 being used as TLS/HTTPS intercept proxy are vulnerable to both problems. __________________________________________________________________ Workaround: Build Squid with --disable-esi __________________________________________________________________ Contact details for the Squid project: For installation / upgrade support on binary packaged versions of Squid: Your first point of contact should be your binary package vendor. If your install and build Squid from the original Squid sources then the squid-users@lists.squid-cache.org mailing list is your primary support point. For subscription details see . For reporting of non-security bugs in the latest STABLE release the squid bugzilla database should be used . For reporting of security sensitive bugs send an email to the squid-bugs@lists.squid-cache.org mailing list. It's a closed list (though anyone can post) and security related bug reports are treated in confidence until the impact has been established. __________________________________________________________________ Credits: The initial issue was reported by "bfek-18". Additional issues and attack vector was reported by "@vftable". Fixed by Amos Jeffries from Treehouse Networks Ltd. __________________________________________________________________ Revision history: 2016-03-02 15:12:12 UTC Initial Report 2016-05-01 23:48:27 UTC Additional Issue Report 2016-05-06 09:39:48 UTC Patches Released 2016-05-06 13:12:00 UTC Packages Released 2016-05-06 14:46:41 UTC CVE Assignment 2016-05-11 13:20:00 UTC Affected Versions clarification. __________________________________________________________________ END