The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues :

  - Fixed multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2015-5400: Improper protection of alternate path.
    (bsc#938715)

  - CVE-2015-3455: Squid http proxy configured with     client-first SSL bumping did not correctly validate     server certificate. (bsc#929493)

  - CVE-2016-3948: Fixed denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: Fixed     multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4553: Fixed cache poisoning issue in HTTP     Request handling (bsc#979009)

  - CVE-2016-4554: Fixed header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fixed multiple Denial of Service issues in ESI Response     processing. (CVE-2016-4555, CVE-2016-4556, bsc#979011,     bsc#979008)

Additionally, the following non-security issues have been fixed :

  - Fix header size in script unsquid.pl. (bsc#902197)

  - Add external helper ext_session_acl to package.
    (bsc#959290)

  - Update forward_max_tries to permit 25 server paths With     cloud sites becoming more popular more CDN servers are     producing long lists of IPv6 and IPv4 addresses. If     there are not enough paths selected the IPv4 ones may     never be reached.

  - squid.init: wait that squid really dies when we kill it     on upgrade instead of proclaiming its demise prematurely     (bnc#963539)

This update was imported from the SUSE:SLE-12:Update update project.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not     properly append data to String objects, which allows     remote servers to cause a denial of service (assertion     failure and daemon exit) via a long string, as     demonstrated by a crafted HTTP Vary     header.(CVE-2016-2569)

  - The Edge Side Includes (ESI) parser in Squid 3.x before     3.5.15 and 4.x before 4.0.7 does not check buffer     limits during XML parsing, which allows remote HTTP     servers to cause a denial of service (assertion failure     and daemon exit) via a crafted XML document, related to     esi/CustomParser.cc and     esi/CustomParser.h.(CVE-2016-2570)

  - http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7     proceeds with the storage of certain data after a     response-parsing failure, which allows remote HTTP     servers to cause a denial of service (assertion failure     and daemon exit) via a malformed     response.(CVE-2016-2571)

  - http.cc in Squid 4.x before 4.0.7 relies on the HTTP     status code after a response-parsing failure, which     allows remote HTTP servers to cause a denial of service     (assertion failure and daemon exit) via a malformed     response.(CVE-2016-2572)

  - Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly     perform bounds checking, which allows remote attackers     to cause a denial of service via a crafted HTTP     response, related to Vary headers.(CVE-2016-3948)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201607-01 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
92994	openSUSE Security Update : squid (openSUSE-2016-988)	Nessus	SuSE Local Security Checks	2016/8/17	2026/1/28	high
99818	EulerOS 2.0 SP1 : squid (EulerOS-SA-2016-1056)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	high
91982	GLSA-201607-01 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/7/11	2021/1/11	high

偵測

搜尋 Plugin

high

high

high