Input validation error in Squid - CVE-2019-18676

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU22909

Input validation error in Squid - CVE-2019-18676

Published: November 22, 2019


Vulnerability identifier: #VU22909
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-18676
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing URIs. A remote attacker can create a specially crafted link, trick the victim into visiting it, trigger buffer overflow and crash the Squid process.


Affected software

Squid
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Opensuse
Ubuntu
Fedora
squid (Debian package)
squid3 (Ubuntu package)
squid (Ubuntu package)
libecap
libecap-devel
squid

How to mitigate CVE-2019-18676

Install updates from vendor's website.

Squid - update to 4.9
squid (Debian package) - update to 4.6-1+deb10u2
squid3 (Ubuntu package) - addressed in versions 3.5.12-1ubuntu7.9, 3.5.27-1ubuntu1.4
squid (Ubuntu package) - addressed in versions 3.5.12-1ubuntu7.12, 3.5.12-1ubuntu7.13, 3.5.27-1ubuntu1.7, 3.5.27-1ubuntu1.8, 4.4-1ubuntu2.3, 4.8-1ubuntu2.1
libecap - update to 1.0.1-2
libecap-devel - update to 1.0.1-2
squid - update to 3.5.20-17.46
squid - addressed in versions 4.9-2.fc30, 4.9-2.fc31
squid - update to 4.11-4

External References

Related Security Bulletins