Information disclosure in Squid - CVE-2019-18679

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU22589

Information disclosure in Squid - CVE-2019-18679

Published: November 7, 2019 / Updated: December 5, 2019


Vulnerability identifier: #VU22589
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-18679
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to incorrect data management when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer which sits within heap memory allocation. This allows a remote attacker to gain knowledge of memory allocations and bypass ASLR protection and help in exploitation of other vulnerabilities.


Affected software

Squid
Arch Linux
Gentoo Linux
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
squid (Debian package)
squid (Alpine package)
squid3 (Ubuntu package)
squid (Ubuntu package)
libecap
libecap-devel
squid

How to mitigate CVE-2019-18679

Install updates from vendor's website.

Squid - update to 4.9
squid (Debian package) - update to 4.6-1+deb10u2
squid (Alpine package) - update to 3.5.27-r4
squid3 (Ubuntu package) - addressed in versions 3.5.12-1ubuntu7.9, 3.5.27-1ubuntu1.4
squid (Ubuntu package) - addressed in versions 4.4-1ubuntu2.3, 4.8-1ubuntu2.1
libecap - update to 1.0.1-2
libecap-devel - update to 1.0.1-2
squid - addressed in versions 4.9-2.fc30, 4.9-2.fc31
squid - update to 4.11-4

External References

Related Security Bulletins