SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Squid Vendors:   Squid-cache.org
Squid ICMP Bugs Let Remote Users Deny Service and Local Users Obtain Potentially Sensitive Information
SecurityTracker Alert ID:  1031261
SecurityTracker URL:  http://securitytracker.com/id/1031261
CVE Reference:   CVE-2014-7141, CVE-2014-7142   (Links to External Site)
Date:  Nov 25 2014
Impact:   Denial of service via network, Disclosure of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.x prior to 3.4.8
Description:   Two vulnerabilities were reported in Squid. A remote user can cause denial of service conditions. A local user can obtain potentially sensitive information.

A remote user can send specially crafted ICMP or ICMPv6 packets to deny service on the target Squid pinger binary or cause the binary to leak potentially sensitive information from the heap to Squid log files.

Sebastian Krahmer of the OpenSUSE Project and Amos Jeffries of Treehouse Networks Ltd. reported these vulnerabilities.

Impact:   A remote user can cause denial of service conditions.

A remote local can obtain potentially sensitive information from the heap.

Solution:   The vendor has issued a fix (3.4.8).

The vendor's advisory is available at:

http://www.squid-cache.org/Advisories/SQUID-2014_4.txt

Vendor URL:  www.squid-cache.org/Advisories/SQUID-2014_4.txt (Links to External Site)
Cause:   Boundary error, Input validation error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC