Out-of-bounds read in Squid - CVE-2019-12529

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU20460

Out-of-bounds read in Squid - CVE-2019-12529

Published: August 29, 2019


Vulnerability identifier: #VU20460
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-12529
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when parsing username in the Proxy-Authorization header during HTTP Basic authentication. A remote attacker can send specially crafted request to the Squid proxy server and retrieve parts of memory contents, if the Squid maintainer had configured the display of usernames on error pages.


Affected software

Squid
squid (Alpine package)
squid (Debian package)
libecap
libecap-devel
squid
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Opensuse
Fedora

How to mitigate CVE-2019-12529

Install updates from vendor's website.

Squid - update to 4.8
squid (Debian package) - update to 4.6-1+deb10u1
libecap - update to 1.0.1-2
libecap-devel - update to 1.0.1-2
squid - addressed in versions 4.8-1.fc29, 4.8-2.fc29
squid - update to 4.11-4

External References

Related Security Bulletins