Out-of-bounds read in Squid - CVE-2019-12854

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU20461

Out-of-bounds read in Squid - CVE-2019-12854

Published: August 29, 2019


Vulnerability identifier: #VU20461
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-12854
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition when terminating strings in cachemgr.cgi. A remote attacker can a specially crafted request to the affected proxy server, trigger out-of-bounds read error and crash the CGI process, denying access to all users on systems with memory access protections.


Affected software

Squid
squid3 (Ubuntu package)
squid (Debian package)
squid (Ubuntu package)
libecap
libecap-devel
squid
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Opensuse
Fedora

How to mitigate CVE-2019-12854

Install updates from vendor's website.

Squid - update to 4.8
squid3 (Ubuntu package) - addressed in versions 3.5.12-1ubuntu7.9, 3.5.27-1ubuntu1.4
squid (Debian package) - update to 4.6-1+deb10u1
squid (Ubuntu package) - addressed in versions 4.4-1ubuntu2.3, 4.8-1ubuntu2.1
libecap - update to 1.0.1-2
libecap-devel - update to 1.0.1-2
squid - addressed in versions 4.8-1.fc29, 4.8-2.fc29
squid - update to 4.11-4

External References

Related Security Bulletins