Information disclosure in Squid - CVE-2016-10002

Vulnerability identifier: #VU8429

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-10002

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to incorrect HTTP conditional request handling. A remote attacker can obtain private and sensitive information about another clients browsing session, including user's credentials.

Successful exploitation of the vulnerability may allow an attacker to obtain potentially sensitive information.

Squid
squid (Alpine package)
squid
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Ubuntu
Fedora

Update to version 3.5.23 or 4.0.17.

squid (Alpine package) - update to 3.5.23-r0
squid - addressed in versions 3.5.23-1.fc24, 4.0.17-1.fc25

• http://www.squid-cache.org/Advisories/SQUID-2016_11.txt

• Information disclosure in Squid
• Ubuntu update for Squid
• Red Hat update for squid
• Information disclosure in squid (Alpine package)
• Fedora 25 update for squid
• Fedora 24 update for squid