[squid-announce] [ADVISORY] SQUID-2020:12 Out-Of-Bounds memory access in WCCPv2

[Amos Jeffries]

__________________________________________________________________

     Squid Proxy Cache Security Update Advisory SQUID-2020:12
__________________________________________________________________

Advisory ID:       | SQUID-2020:12
Date:              | Oct 03, 2021
Summary:           | Out-Of-Bounds memory access in WCCPv2
Affected versions: | Squid 2.6 -> 2.7.STABLE9
                    | Squid 3.x -> 3.5.28
                    | Squid 4.x -> 4.16
                    | Squid 5.x -> 5.1
Fixed in version:  | Squid 4.17 and 5.2
__________________________________________________________________

   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28116>
   <https://www.zerodayinitiative.com/advisories/ZDI-CAN-11610>
__________________________________________________________________

Problem Description:

  Due to an out of bounds memory access Squid is vulnerable to an
  information leak vulnerability when processing WCCPv2 messages.

__________________________________________________________________

Severity:

  This problem allows a WCCPv2 sender to corrupt Squids list of
  known WCCP routers and divert client traffic to attacker
   controlled routers.

  This attack is limited to Squid proxy with WCCPv2 enabled and
  IP spoofing of a router IP address configured as trusted in
  squid.conf.

CVSS Score of 7.7
<https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:X/RL:O/RC:C/CR:H/IR:H/AR:X/MAV:N/MAC:H/MPR:N/MUI:X/MS:U/MC:H/MI:H/MA:X&version=3.1>

__________________________________________________________________

Updated Packages:

This bug is fixed by Squid versions 4.17 and 5.2.

  In addition, patches addressing this problem for the stable
  releases can be found in our patch archives:

Squid 4:
  <http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_12.patch>

Squid 5:
 
<http://www.squid-cache.org/Versions/v5/changesets/squid-5-7a73a54cefff6bb83c03de219a73276e42d183d0.patch>

  If you are using a prepackaged version of Squid then please
  refer to the package vendor for availability information on
  updated packages.

__________________________________________________________________

Determining if your version is vulnerable:

  All Squid built with --disable-wccpv2 are not vulnerable.

  All Squid-3.x up to and including 3.5.28 built with
  --enable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

  All Squid-3.x up to and including 3.5.28 built without
  --disable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

  All Squid-4.x up to and including 4.16 built with
  --enable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

  All Squid-4.x up to and including 4.16 built without
  --disable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

  All Squid-5.x up to and including 5.1 built with
  --enable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

  All Squid-5.x up to and including 5.1 built without
  --disable-wccpv2 and configured with wccp2_router in squid.conf
  are vulnerable.

__________________________________________________________________

Workaround:

Either,

The following network security Best Practices will greatly
restrict the ability of any attacker utilizing this
vulnerability. They can be considered workarounds for this
issue:

  * Use Private IP address for control communications (eg WCCPv2)
    with routers.

  * Firewall restriction of UDP traffic on port 2048 and any
    other UDP ports used for WCCP(v2) control messages to only
    permit known devices to communicate with WCCP(v2).

    Note that ports used by clients and diverted by WCCP (eg 80
    or 443) are not relevant.

  * Ensure the network implements BCP 38 spoofing protection.
    Include protection against LAN traffic spoofing as much as
    possible.
    See also <http://www.bcp38.info> and 
<https://tools.ietf.org/html/bcp38>.

Or,

  Build Squid with --disable-wccpv2

Or,

  Remove all lines for wccp2_* directives from squid.conf.
  The default configuration is not to enable WCCPv2.

__________________________________________________________________

Contact details for the Squid project:

  For installation / upgrade support on binary packaged versions
  of Squid: Your first point of contact should be your binary
  package vendor.

  If you install and build Squid from the original Squid sources
  then the <squid-users at lists.squid-cache.org> mailing list is
  your primary support point. For subscription details see
  <http://www.squid-cache.org/Support/mailing-lists.html>.

  For reporting of non-security bugs in the latest STABLE release
  the squid bugzilla database should be used
  <http://bugs.squid-cache.org/>.

  For reporting of security sensitive bugs send an email to the
  <squid-bugs at lists.squid-cache.org> mailing list. It's a closed
  list (though anyone can post) and security related bug reports
  are treated in confidence until the impact has been established.

__________________________________________________________________

Credits:

  This vulnerability was discovered by Lyu working with Trend
  Micro Zero Day Initiative.

  Fixed by Amos Jeffries of Treehouse Networks Ltd.

__________________________________________________________________

Revision history:

  2020-08-17 10:43:36 UTC Initial Report
  2021-02-09 00:00:00 UTC Advisory Release by ZDI
  2021-10-03 00:00:00 UTC Packages Released

__________________________________________________________________
END