Multiple vulnerabilities have been found in Squid, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 4.15 | >= 4.15 |
Squid is a full-featured Web proxy cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features.
Multiple vulnerabilities have been discovered in Squid. Please review the CVE identifiers referenced below for details.
A remote attacker could send a specially crafted request, possibly resulting in a Denial of Service condition or information leak.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-4.15"
Multiple vulnerabilities have been found in Squid, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 4.11 | >= 4.11 |
Squid is a full-featured Web proxy cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features.
Multiple vulnerabilities have been discovered in Squid. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-4.11"
Multiple vulnerabilities have been found in Squid, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 4.10 | >= 4.10 |
Squid is a full-featured Web proxy cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features.
Multiple vulnerabilities have been discovered in Squid. Please review the CVE identifiers referenced below for details.
A remote attacker, by sending a specially crafted request, could possibly execute arbitrary code with the privileges of the process, obtain sensitive information or cause a Denial of Service condition.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-4.10"
Multiple vulnerabilities have been found in Squid, the worst of which could lead to arbitrary code execution, or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 3.5.19 | >= 3.5.19 |
Squid is a full-featured Web proxy cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features.
Multiple vulnerabilities have been discovered in Squid. Please review the CVE identifiers referenced below for details.
An attacker can possibly execute arbitrary code or create a Denial of Service condition.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-3.5.19"
Multiple vulnerabilities have been found in Squid, allowing remote attackers to execute arbitrary code or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 3.3.13-r1 | >= 3.3.13-r1 |
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more.
An assertion failure in processing of SSL-Bump has been found in Squid. Heap based overflow is discovered when processing SNMP requests.
A remote attacker could send a specially crafted request, possibly resulting in a executing of arbitrary code or Denial of Service condition.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-3.3.13-r1"
Multiple vulnerabilities have been found in Squid, possibly resulting in remote Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 3.2.13 | >= 3.2.13 |
Squid is a full-featured web proxy cache.
Multiple vulnerabilities have been discovered in Squid. Please review the CVE identifiers referenced below for details.
A remote attacker may be able to bypass ACL restrictions or cause a Denial of Service condition.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-3.2.13"
Multiple vulnerabilities were found in Squid allowing attackers to execute arbitrary code or cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 3.1.15 | >= 3.1.15 |
Squid is a full-featured web proxy cache.
Multiple vulnerabilities have been discovered in Squid. Please review the CVE identifiers referenced below for details.
Remote unauthenticated attackers may be able to execute arbitrary code with the privileges of the Squid process or cause a Denial of Service.
There is no known workaround at this time.
All squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-3.1.15"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since September 4, 2011. It is likely that your system is already no longer affected by this issue.
Multiple vulnerabilities have been found in Squid which allow for remote Denial of Service attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 2.7.6 | >= 2.7.6 |
Squid is a full-featured web proxy cache.
The issues allows for Denial of Service attacks against the service via an HTTP request with an invalid version number and other specially crafted requests.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-2.7.6"
A Denial of Service vulnerability has been reported in Squid.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 2.6.17 | >= 2.6.17 |
Squid is a multi-protocol proxy server.
The Wikimedia Foundation reported a memory leak vulnerability when performing cache updates.
A remote attacker could perform numerous specially crafted requests to the vulnerable server, resulting in a Denial of Service.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-2.6.17"
Squid is affected by a Denial of Service vulnerability.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 2.6.12 | >= 2.6.12 |
Squid is a multi-protocol proxy server.
Squid incorrectly handles TRACE requests that contain a "Max-Forwards" header field with value "0" in the clientProcessRequest() function.
A remote attacker can send specially crafted TRACE HTTP requests that will terminate the child process. A quickly repeated attack will lead to a Denial of Service.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-2.6.12"
Two vulnerabilities have been found in Squid which make it susceptible to Denial of Service attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 2.6.7 | >= 2.6.7 |
Squid is a multi-protocol proxy server.
Squid fails to correctly handle ftp:// URI's. There is also an error in the external_acl queue which can cause an infinite looping condition.
An attacker could attempt to retrieve a specially crafted URI via a Squid server causing the service to crash. If an attacker could generate a sufficiently high load on the Squid services, they could cause a Denial of Service by forcing Squid into an infinite loop.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-2.6.7"
Squid contains several bugs when handling certain malformed requests resulting in a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 2.5.10-r2 | >= 2.5.10-r2 |
Squid is a full-featured Web proxy cache designed to run on Unix-like systems. It supports proxying and caching of HTTP, FTP, and other protocols, as well as SSL support, cache hierarchies, transparent caching, access control lists and many more features.
Certain malformed requests result in a segmentation fault in the sslConnectTimeout function, handling of other certain requests trigger assertion failures.
By performing malformed requests an attacker could cause Squid to crash by triggering an assertion failure or invalid memory reference.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-2.5.10-r2"
Squid contains a bug in the handling of certain DNS responses resulting in a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 2.5.8 | >= 2.5.8 |
Squid is a full-featured Web proxy cache designed to run on Unix-like systems. It supports proxying and caching of HTTP, FTP, and other protocols, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features.
Handling of certain DNS responses trigger assertion failures.
By returning a specially crafted DNS response an attacker could cause Squid to crash by triggering an assertion failure.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-2.5.8"
Squid contains vulnerabilities in the code handling WCCP, HTTP and LDAP which could lead to Denial of Service, access control bypass, web cache and log poisoning.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 2.5.7-r5 | >= 2.5.7-r5 |
Squid is a full-featured Web proxy cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other protocols, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features.
Squid contains several vulnerabilities:
An attacker could exploit:
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-2.5.7-r5"
Squid contains vulnerabilities in the the code handling NTLM (NT Lan Manager), Gopher to HTML, ACLs and WCCP (Web Cache Communication Protocol) which could lead to ACL bypass, denial of service and arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 2.5.7-r2 | >= 2.5.7-r2 |
Squid is a full-featured Web proxy cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features.
Squid contains a vulnerability in the gopherToHTML function (CAN-2005-0094) and incorrectly checks the 'number of caches' field when parsing WCCP_I_SEE_YOU messages (CAN-2005-0095). Furthermore the NTLM code contains two errors. One is a memory leak in the fakeauth_auth helper (CAN-2005-0096) and the other is a NULL pointer dereferencing error (CAN-2005-0097). Finally Squid also contains an error in the ACL parsing code (CAN-2005-0194).
With the WCCP issue an attacker could cause denial of service by sending a specially crafted UDP packet. With the Gopher issue an attacker might be able to execute arbitrary code by enticing a user to connect to a malicious Gopher server. The NTLM issues could lead to denial of service by memory consumption or by crashing Squid. The ACL issue could lead to ACL bypass.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-2.5.7-r2"
Squid contains a vulnerability in the SNMP module which may lead to a denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 2.5.7 | >= 2.5.7 |
Squid is a full-featured Web proxy cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features.
A parsing error exists in the SNMP module of Squid where a specially-crafted UDP packet can potentially cause the server to restart, closing all current connections. This vulnerability only exists in versions of Squid compiled with the 'snmp' USE flag.
An attacker can repeatedly send these malicious UDP packets to the Squid server, leading to a denial of service.
Disable SNMP support or filter the port that has SNMP processing (default is 3401) to allow only SNMP data from trusted hosts.
To disable SNMP support put the entry snmp_port 0 in the squid.conf configuration file.
To allow only the local interface to process SNMP, add the entry "snmp_incoming_address 127.0.0.1" in the squid.conf configuration file.
All Squid users should upgrade to the latest version:
# emerge sync # emerge -pv ">=net-proxy/squid-2.5.7" # emerge ">=net-proxy/squid-2.5.7"
Squid is vulnerable to a denial of service attack which could crash its NTLM helpers.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | <= 2.5.6-r1 | >= 2.5.6-r2, < 2.5 |
Squid is a full-featured Web Proxy Cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features.
Squid 2.5.x versions contain a bug in the functions ntlm_fetch_string() and ntlm_get_string() which lack checking the int32_t offset "o" for negative values.
A remote attacker could cause a denial of service situation by sending certain malformed NTLMSSP packets if NTLM authentication is enabled.
Disable NTLM authentication by removing any "auth_param ntlm program ..." directives from squid.conf or use ntlm_auth from Samba-3.x.
All Squid users should upgrade to the latest stable version:
# emerge sync # emerge -pv ">=net-www/squid-2.5.6-r2" # emerge ">=net-www/squid-2.5.6-r2"
Squid contains a bug where it fails to properly check bounds of the 'pass' variable.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | <= 2.5.5-r1 | >= 2.5.5-r2 |
Squid contains a bug in the function ntlm_check_auth(). It fails to do proper bounds checking on the values copyied to the 'pass' variable.
Squid is a full-featured Web Proxy Cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features.
If Squid is configured to use NTLM authentication, an attacker could exploit this vulnerability by sending a very long password. This could lead to arbitrary code execution with the permissions of the user running Squid.
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version.
All Squid users should upgrade to the latest stable version:
# emerge sync # emerge -pv ">=net-proxy/squid-2.5.5-r2" # emerge ">=net-proxy/squid-2.5.5-r2"
Squid versions 2.0 through to 2.5.STABLE4 could allow a remote attacker to bypass Access Control Lists by sending a specially-crafted URL request containing '%00': in such circumstances; the url_regex ACL may not properly detect the malicious URL, allowing the attacker to effectively bypass the ACL.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/squid | * | < 2.5.5 | >= 2.5.5 |
Squid is a fully-featured Web Proxy Cache designed to run on Unix systems that supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features.
A bug in Squid allows users to bypass certain access controls by passing a URL containing "%00" which exploits the Squid decoding function. This may insert a NUL character into decoded URLs, which may allow users to bypass url_regex access control lists that are enforced upon them.
In such a scenario, Squid will insert a NUL character after the"%00" and it will make a comparison between the URL to the end of the NUL character rather than the contents after it: the comparison does not result in a match, and the user's request is not denied.
Restricted users may be able to bypass url_regex access control lists that are enforced upon them which may cause unwanted network traffic as well as a route for other possible exploits. Users of Squid 2.5STABLE4 and below who require the url_regex features are recommended to upgrade to 2.5STABLE5 to maintain the security of their infrastructure.
A workaround is not currently known for this issue. All users are advised to upgrade to the latest version of Squid.
Squid can be updated as follows:
# emerge sync # emerge -pv ">=net-proxy/squid-2.5.5" # emerge ">=net-proxy/squid-2.5.5"