__________________________________________________________________ Squid Proxy Cache Security Update Advisory SQUID-2018:3 __________________________________________________________________ Advisory ID: SQUID-2018:3 Date: April 18, 2018 Summary: Denial of Service issue in ESI Response processing. Affected versions: Squid 3.1.12.2 -> 3.1.23 Squid 3.2.0.8 -> 3.2.14 Squid 3.3 -> 3.5.27 Squid 4.x -> 4.0.12 Fixed in version: Squid 4.0.13 __________________________________________________________________ http://www.squid-cache.org/Advisories/SQUID-2018_3.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1172 __________________________________________________________________ Problem Description: Due to incorrect pointer handling Squid is vulnerable to denial of service attack when processing ESI responses. __________________________________________________________________ Severity: This problem allows a remote server delivering ESI responses to trigger a denial of service for all clients accessing the Squid service. This problem is limited to Squid operating as reverse proxy. __________________________________________________________________ Updated Packages: This bug is fixed by Squid version 4.0.13. In addition, patches addressing this problem for the stable releases can be found in our patch archives: Squid 3.5: If you are using a prepackaged version of Squid then please refer to the package vendor for availability information on updated packages. __________________________________________________________________ Determining if your version is vulnerable: All Squid-2.x and older are not vulnerable. All Squid-3.0 and older version are not vulnerable. All Squid built with --disable-esi are not vulnerable. All Squid-3.x versions up to and including 3.4.14 built with --disable-ssl are not vulnerable. All Squid-3.x versions up to and including 3.4.14 built without --enable-ssl are not vulnerable. All Squid-3.x versions up to and including 3.5.27 built without --enable-esi are not vulnerable. All Squid-3.1.12.2 and later versions up to and including Squid-3.1.23 built with --enable-esi and--enable-ssl, and being used for reverse-proxy are vulnerable. All Squid-3.2.0.8 and later versions up to and including Squid-3.2.14 built with --enable-esi and --enable-ssl, and being used for reverse-proxy are vulnerable. All Squid-3.3 and later versions up to and including Squid-3.3.14 built with --enable-esi and --enable-ssl, and being used for reverse-proxy are vulnerable. All Squid-3.4 and later versions up to and including Squid-3.4.14 built with --enable-esi and --enable-ssl, and being used for reverse-proxy are vulnerable. All Squid-3.5 versions up to and including 3.5.27 built without --with-openssl are not vulnerable. All Squid-3.5 and later versions up to and including 3.5.27 built with --enable-esi and --with-openssl, and being used for reverse-proxy are vulnerable. All Squid-4 versions up to and including 4.0.12 built without --with-openssl are not vulnerable. All Squid-4 versions up to and including 4.0.12 built with --with-openssl and being used for reverse-proxy are vulnerable. __________________________________________________________________ Workarounds: Either; Build Squid with --disable-esi Or, Build Squid-3.1 to 3.4.14 or later with "--disable-ssl" Or, Build Squid-3.5 or later with "--without-openssl" __________________________________________________________________ Contact details for the Squid project: For installation / upgrade support on binary packaged versions of Squid: Your first point of contact should be your binary package vendor. If your install and build Squid from the original Squid sources then the squid-users@lists.squid-cache.org mailing list is your primary support point. For subscription details see . For reporting of non-security bugs in the latest STABLE release the squid bugzilla database should be used . For reporting of security sensitive bugs send an email to the squid-bugs@lists.squid-cache.org mailing list. It's a closed list (though anyone can post) and security related bug reports are treated in confidence until the impact has been established. __________________________________________________________________ Credits: This vulnerability was discovered by Michael Marshall of Trend Micro working with Trend Micro's Zero Day Initiative. Fixed by Christos Tsantilas on behalf of Measurement Factory. __________________________________________________________________ Revision history: 2018-04-16 18:20:15 UTC Initial Report 2018-04-16 22:02:25 UTC Patches Released 2018-04-18 12:28:00 UTC Advisory Released 2018-07-28 04:24:00 UTC Update after 3.5.28 release __________________________________________________________________ END