Squid Conditional Request Handling Flaw Lets Remote Users Obtain Potentially Sensitive Information on the Target System
|
|
SecurityTracker Alert ID: 1037513 |
|
SecurityTracker URL: http://securitytracker.com/id/1037513
|
|
CVE Reference:
CVE-2016-10002
(Links to External Site)
|
Date: Dec 21 2016
|
Impact:
Disclosure of authentication information, Disclosure of system information, Disclosure of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 3.1 - 3.5.22, 4.0 - 4.0.16
|
Description:
A vulnerability was reported in Squid. A remote user can obtain potentially sensitive information on the target system.
A remote user can send a specially crafted request to trigger a flaw in the processing of conditional requests and cause the target system to return responses containing potentially sensitive information about another client's browsing session. This information may include authentication credentials.
Saulius Lapinskas from Lithuanian State Social Insurance Fund Board reported this vulnerability.
|
Impact:
A remote user can obtain potentially sensitive information about other user sessions on the target system.
|
Solution:
The vendor has issued a fix (3.5.23, 4.0.17).
The vendor advisory is available at:
http://www.squid-cache.org/Advisories/SQUID-2016_11.txt
|
Vendor URL: www.squid-cache.org/Advisories/SQUID-2016_11.txt (Links to External Site)
|
Cause:
Access control error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
