Heap-based buffer overflow in Squid - CVE-2019-12526

Vulnerability identifier: #VU22585

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-12526

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing URN requests. A remote attacker can send specially crafted request to the Squid client, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Squid
Arch Linux
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Opensuse
Fedora
squid (Debian package)
squid3 (Ubuntu package)
squid (Ubuntu package)
libecap
libecap-devel
squid

Install updates from vendor's website.

Squid - update to 4.9
squid (Debian package) - update to 4.6-1+deb10u2
squid3 (Ubuntu package) - addressed in versions 3.5.12-1ubuntu7.9, 3.5.27-1ubuntu1.4
squid (Ubuntu package) - addressed in versions 4.4-1ubuntu2.3, 4.8-1ubuntu2.1
libecap - update to 1.0.1-2
libecap-devel - update to 1.0.1-2
squid - update to 3.5.20-17.49
squid - addressed in versions 4.9-2.fc30, 4.9-2.fc31
squid - update to 4.11-4

• http://www.squid-cache.org/Advisories/SQUID-2019_7.txt

• Arch Linux update for squid
• Multiple vulnerabilities in Squid proxy server
• OpenSUSE Linux update for squid
• OpenSUSE Linux update for squid
• Ubuntu update for Squid
• Gentoo update for Squid
• Debian update for squid
• Red Hat Enterprise Linux 8 update for the squid:4 module
• Amazon Linux AMI update for squid
• Anolis OS update for squid:4 (Anolis OS 8.4) module
• Fedora 30 update for squid
• Fedora 31 update for squid