SB2021032643 - openEuler update for squid

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Exposed dangerous method or function (CVE-ID: CVE-2020-14058)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to usage of potentially dangerous function when processing TLS certificates. A remote client can perform a denial of service attack when opening TLS connections.

2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2020-15810)

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote authenticated attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

3) HTTP response splitting (CVE-ID: CVE-2020-15811)

The vulnerability allows a remote attacker to perform HTTP splitting attacks.

The vulnerability exists due to software does not corrector process CRLF character sequences. A remote authenticated attacker can send specially crafted request containing CRLF sequence and make the application to send a split HTTP response.

Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.

4) Resource exhaustion (CVE-ID: CVE-2020-24606)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly EOF in peerDigestHandleReply() function in peer_digest.cc when processing Cache Digest response messages from a trusted peer. A remote attacker who controls a trusted peer can consume all available CPU cycles and perform a denial of service (DoS) attack.

This attack is limited to Squid using cache_peer with cache digests feature.

5) Integer overflow (CVE-ID: CVE-2020-11945)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow when processing HTTP Digest Authentication tokens, if memory pooling is disabled. A remote attacker can pass a specially crafted authentication nonce and execute arbitrary code on the server through the free'd nonce credentials.

In case memory pooling is enabled, a remote attacker can replay a sniffed Digest Authentication nonce to gain access  to resources that are otherwise forbidden.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

6) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2020-15049)

The vulnerability allows a remote attacker to perform cache poisoning attack.

The vulnerability exists in the way Squid processes client's requests. A remote client can send specially crafted data in the request to perform request smuggling and poison the HTTP cache contents with crafted HTTP(S) request messages.

Successful exploitation of the vulnerability requires an upstream server to participate in the smuggling and generate the poison response sequence.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1092