Amazon Linux AMI update for squid



Published: 2023-02-23
Risk Medium
Patch available YES
Number of vulnerabilities 7
CVE-ID CVE-2021-28651
CVE-2021-28652
CVE-2021-31806
CVE-2021-31807
CVE-2021-31808
CVE-2021-33620
CVE-2022-41317
CWE-ID CWE-20
CWE-401
CWE-399
CWE-190
CWE-284
Exploitation vector Network
Public exploit Public exploit code for vulnerability #3 is available.
Public exploit code for vulnerability #4 is available.
Vulnerable software
Subscribe 		Amazon Linux AMI
Operating systems & Components / Operating system

squid
Operating systems & Components / Operating system package or component

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 7 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU53017

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28651

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when resolving "urn:" resource identifiers. A remote attacker can trick a user behind the proxy server to click on a specially crafted "urn:" link that leads to a server under attacker's control and force Squid to consume arbitrarily large amounts of memory on the server. 

Mitigation

Update the affected packages:

i686:
    squid-migration-script-3.5.20-17.44.amzn1.i686
    squid-3.5.20-17.44.amzn1.i686
    squid-debuginfo-3.5.20-17.44.amzn1.i686

src:
    squid-3.5.20-17.44.amzn1.src

x86_64:
    squid-debuginfo-3.5.20-17.44.amzn1.x86_64
    squid-migration-script-3.5.20-17.44.amzn1.x86_64
    squid-3.5.20-17.44.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

squid: before 3.5.20-17.44

External links

http://alas.aws.amazon.com/ALAS-2023-1687.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU53019

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28652

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote client to perform DoS attack on the target system.

The vulnerability exists due memory leak due to incorrect parser validation in Cache Manager API. A remote trusted client with Cache Manager API access privilege can perform denial of service attack.

Mitigation

Update the affected packages:

i686:
    squid-migration-script-3.5.20-17.44.amzn1.i686
    squid-3.5.20-17.44.amzn1.i686
    squid-debuginfo-3.5.20-17.44.amzn1.i686

src:
    squid-3.5.20-17.44.amzn1.src

x86_64:
    squid-debuginfo-3.5.20-17.44.amzn1.x86_64
    squid-migration-script-3.5.20-17.44.amzn1.x86_64
    squid-3.5.20-17.44.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

squid: before 3.5.20-17.44

External links

http://alas.aws.amazon.com/ALAS-2023-1687.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU53020

Risk: Medium

CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2021-31806

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote client to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when performing HTTP Range requests. A remote proxy client can send specially crafted HTTP request via the proxy server  and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    squid-migration-script-3.5.20-17.44.amzn1.i686
    squid-3.5.20-17.44.amzn1.i686
    squid-debuginfo-3.5.20-17.44.amzn1.i686

src:
    squid-3.5.20-17.44.amzn1.src

x86_64:
    squid-debuginfo-3.5.20-17.44.amzn1.x86_64
    squid-migration-script-3.5.20-17.44.amzn1.x86_64
    squid-3.5.20-17.44.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

squid: before 3.5.20-17.44

External links

http://alas.aws.amazon.com/ALAS-2023-1687.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

4) Resource management error

EUVDB-ID: #VU53599

Risk: Medium

CVSSv3.1: 7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2021-31807

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of memory within the application when processing HTTP Range header. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    squid-migration-script-3.5.20-17.44.amzn1.i686
    squid-3.5.20-17.44.amzn1.i686
    squid-debuginfo-3.5.20-17.44.amzn1.i686

src:
    squid-3.5.20-17.44.amzn1.src

x86_64:
    squid-debuginfo-3.5.20-17.44.amzn1.x86_64
    squid-migration-script-3.5.20-17.44.amzn1.x86_64
    squid-3.5.20-17.44.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

squid: before 3.5.20-17.44

External links

http://alas.aws.amazon.com/ALAS-2023-1687.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

5) Integer overflow

EUVDB-ID: #VU53021

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31808

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote client to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when delivering responses from HTTP Range requests. A remote proxy client can send specially crafted HTTP request via the proxy server, force the server to initiate a necessary response, trigger integer overflow in Squid and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    squid-migration-script-3.5.20-17.44.amzn1.i686
    squid-3.5.20-17.44.amzn1.i686
    squid-debuginfo-3.5.20-17.44.amzn1.i686

src:
    squid-3.5.20-17.44.amzn1.src

x86_64:
    squid-debuginfo-3.5.20-17.44.amzn1.x86_64
    squid-migration-script-3.5.20-17.44.amzn1.x86_64
    squid-3.5.20-17.44.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

squid: before 3.5.20-17.44

External links

http://alas.aws.amazon.com/ALAS-2023-1687.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU65362

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33620

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote server to perform a denial of service (DoS) attack.

The vulnerability can be triggered by a header that can be expected to exist in HTTP traffic without any malicious intent by the server. A remote server can trigger the vulnerability and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    squid-migration-script-3.5.20-17.44.amzn1.i686
    squid-3.5.20-17.44.amzn1.i686
    squid-debuginfo-3.5.20-17.44.amzn1.i686

src:
    squid-3.5.20-17.44.amzn1.src

x86_64:
    squid-debuginfo-3.5.20-17.44.amzn1.x86_64
    squid-migration-script-3.5.20-17.44.amzn1.x86_64
    squid-3.5.20-17.44.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

squid: before 3.5.20-17.44

External links

http://alas.aws.amazon.com/ALAS-2023-1687.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper access control

EUVDB-ID: #VU67604

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41317

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to inconsistent handling of internal URIs. A remote authenticated proxy user can bypass the manager ACL protection and access cache manager information, which includes records of internal network structure, client credentials, client identity and client traffic behavior.

Mitigation

Update the affected packages:

i686:
    squid-migration-script-3.5.20-17.44.amzn1.i686
    squid-3.5.20-17.44.amzn1.i686
    squid-debuginfo-3.5.20-17.44.amzn1.i686

src:
    squid-3.5.20-17.44.amzn1.src

x86_64:
    squid-debuginfo-3.5.20-17.44.amzn1.x86_64
    squid-migration-script-3.5.20-17.44.amzn1.x86_64
    squid-3.5.20-17.44.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

squid: before 3.5.20-17.44

External links

http://alas.aws.amazon.com/ALAS-2023-1687.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###