__________________________________________________________________
Squid Proxy Cache Security Update Advisory SQUID-2020:4
__________________________________________________________________
Advisory ID: SQUID-2020:4
Date: April 23, 2020
Summary: Multiple issues
in HTTP Digest authentication.
Affected versions: Squid 2.x -> 2.7.STABLE9
Squid 3.x -> 3.5.28
Squid 4.x -> 4.10
Squid 5.x -> 5.0.1
Fixed in version: Squid 4.11 and 5.0.2
__________________________________________________________________
http://www.squid-cache.org/Advisories/SQUID-2020_4.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11945
__________________________________________________________________
Problem Description:
Due to an integer overflow bug Squid is vulnerable to credential
replay and remote code execution attacks against HTTP Digest
Authentication tokens.
__________________________________________________________________
Severity:
When memory pooling is used this problem allows a remote client
to replay a sniffed Digest Authentication nonce to gain access
to resources that are otherwise forbidden.
When memory pooling is disabled this problem allows a remote
client to perform remote code execution through the free'd nonce
credentials.
__________________________________________________________________
Updated Packages:
This bug is fixed by Squid versions 4.11 and 5.0.2.
In addition, patches addressing this problem for the stable
releases can be found in our patch archives:
Squid 4:
<http://www.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e85ae34b02c34e9a811.patch>
If you are using a prepackaged version of Squid then please refer
to the package vendor for availability information on updated
packages.
__________________________________________________________________
Determining if your version is vulnerable:
All Squid-2.x up to and including 2.4.STABLE7 are not vulnerable.
All Squid-2.5 up to and including 2.7.STABLE9 are vulnerable.
All Squid-2.x up to and including 2.7.STABLE9 configured with
"auth_param digest" are vulnerable.
All Squid-2.x up to and including 2.7.STABLE9 configured without
"auth_param digest" are not vulnerable.
All Squid-3.x up to and including 3.5.28 built with
--disable-auth are not vulnerable.
All Squid-3.2 up to and including 3.5.28 built with
--disable-auth-digest are not vulnerable.
All Squid-3.x up to and including 3.5.28 configured with
"auth_param digest" are vulnerable.
All Squid-3.x up to and including 3.5.28 configured without
"auth_param digest" are not vulnerable.
All Squid-4.x up to and including 4.10 built with
--disable-auth are not vulnerable.
All Squid-4.x up to and including 4.10 built with
--disable-auth-digest are not vulnerable.
All Squid-4.x up to and including 4.10 configured with
"auth_param digest" are vulnerable.
All Squid-4.x up to and including 4.10 configured without
"auth_param digest" are not vulnerable.
Squid-5.0.1 built with --disable-auth-digest is not vulnerable.
Squid-5.0.1 configured with "auth_param digest" are vulnerable.
Squid-5.0.1 configured without "auth_param digest" are not
vulnerable.
__________________________________________________________________
Workaround:
Either,
Remove all "auth_param digest" lines from squid.conf
Or,
Build Squid with --disable-auth-digest
Or,
Build Squid with --disable-auth
__________________________________________________________________
Contact details for the Squid project:
For installation / upgrade support on binary packaged versions
of Squid: Your first point of contact should be your binary
package vendor.
If your install and build Squid from the original Squid sources
then the squid-users@xxxxxxxxxxxxxxxxxxxxx mailing list is your
primary support point. For subscription details see
<http://www.squid-cache.org/Support/mailing-lists.html>.
For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used
<http://bugs.squid-cache.org/>.
For reporting of security sensitive bugs send an email to the
squid-bugs@xxxxxxxxxxxxxxxxxxxxx mailing list. It's a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.
__________________________________________________________________
Credits:
This vulnerability was discovered by Clément Berthaux and
Florian Guilbert of Synacktiv.
Fixed by Maxime Desbrus of Synacktiv.
__________________________________________________________________
Revision history:
2019-11-20 13:39:07 UTC Initial Report
2020-04-02 11:16:45 UTC Patches Released
2020-04-20 20:08:14 UTC CVE Assignment
2020-04-23 08:00:00 UTC Advisory Released
__________________________________________________________________
END
_______________________________________________
squid-announce mailing list
squid-announce@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-announce
