Heap-based buffer overflow in Squid - CVE-2019-12527
Published: July 15, 2019
Vulnerability identifier: #VU19169
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-12527
CWE-ID: CWE-122
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when checking Basic Authentication with HttpHeader::getAuth. A remote attacker can send an overly long authentication string, trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Squid
Arch Linux
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
squid (Debian package)
squid
Arch Linux
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
squid (Debian package)
squid
How to mitigate CVE-2019-12527
Install updates from vendor's website.
Squid - update to 4.8
squid (Debian package) - update to 4.6-1+deb10u1
squid - addressed in versions 4.8-1.fc29, 4.8-2.fc29
squid (Debian package) - update to 4.6-1+deb10u1
squid - addressed in versions 4.8-1.fc29, 4.8-2.fc29