Resource exhaustion in Squid - CVE-2020-24606

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU45957

Resource exhaustion in Squid - CVE-2020-24606

Published: August 23, 2020 / Updated: August 25, 2020


Vulnerability identifier: #VU45957
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H]
CVE-ID: CVE-2020-24606
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly EOF in peerDigestHandleReply() function in peer_digest.cc when processing Cache Digest response messages from a trusted peer. A remote attacker who controls a trusted peer can consume all available CPU cycles and perform a denial of service (DoS) attack.

This attack is limited to Squid using cache_peer with cache digests feature.


Affected software

Squid
Amazon Linux AMI
Red Hat Enterprise Linux for Power, big endian
Anolis OS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Opensuse
Ubuntu
openEuler
Fedora
squid (Alpine package)
squid (Debian package)
libecap
libecap-devel
squid (Ubuntu package)
squid-sysvinit
squid-migration-script
squid
squid (Red Hat package)
squid-debuginfo
squid-debugsource

How to mitigate CVE-2020-24606

Install updates from vendor's website.

Squid - addressed in versions 4.13, 5.0.4
squid (Debian package) - update to 4.6-1+deb10u4
libecap - update to 1.0.1-2
libecap-devel - update to 1.0.1-2
squid (Ubuntu package) - addressed in versions 3.5.12-1ubuntu7.15, 3.5.27-1ubuntu1.9, 4.10-1ubuntu1.2
squid-sysvinit - update to 3.5.20-17
squid-migration-script - update to 3.5.20-17
squid - addressed in versions 3.5.20-17, 4.11-4
squid (Red Hat package) - update to 3.5.20-17.el7_9.4
squid-debuginfo - update to 4.9-5
squid-debugsource - update to 4.9-5
squid - update to 4.9-5
squid - addressed in versions 4.13-1.fc31, 4.13-1.fc32, 4.13-1.fc33

External References

Related Security Bulletins