[squid-announce] [ADVISORY] SQUID-2015:3 Multiple Remote Denial of service issues in SSL/TLS processing

[Amos Jeffries]

__________________________________________________________________

    Squid Proxy Cache Security Update Advisory SQUID-2015:3
__________________________________________________________________

Advisory ID:            SQUID-2015:3
Date:                   September 17, 2015
Summary:                Multiple Remote Denial of service issues
                        in SSL/TLS processing.
Affected versions:      Squid 3.5.0.1 -> 3.5.8
Fixed in version:       Squid 3.5.9
__________________________________________________________________

    http://www.squid-cache.org/Advisories/SQUID-2015_3.txt
__________________________________________________________________

Problem Description:

 Due to integer overflow issues Squid is vulnerable to a denial
 of service attack when processing SSL or TLS messages.

 Due to lack of input validation Squid is vulnerable to a denial
 of service attack when processing SSL or TLS messages.

__________________________________________________________________

Severity:

 These problems allow any trusted client or external server to
 perform a denial of service attack on the Squid service and all
 other services on the same machine.

 There exists popular software which triggers these bugs
 unintentionally.

 However, the bugs are exploitable only if you have configured a
 Squid-3.5 listening port with ssl-bump.

__________________________________________________________________

Updated Packages:

 These bugs are fixed by Squid version 3.5.9.

 If you are using a prepackaged version of Squid then please refer
 to the package vendor for availability information on updated
 packages.

__________________________________________________________________

Determining if your version is vulnerable:

 All Squid-3.4 and older versions are not vulnerable.

 All Squid-3.5 built without OpenSSL support are not vulnerable.

 All unpatched Squid-3.5 with http_port or https_port configured
 with the ssl-bump option in squid.conf are vulnerable.

 The following command can be used to easily determine if a
 vulnerable configuration is being used:
   squid -k parse 2>&1 | grep ssl-bump

__________________________________________________________________

Workaround:

 Remove ssl-bump configuration options from squid.conf

__________________________________________________________________

Contact details for the Squid project:

 For installation / upgrade support on binary packaged versions
 of Squid: Your first point of contact should be your binary
 package vendor.

 If your install and build Squid from the original Squid sources
 then the squid-users at squid-cache.org mailing list is your primary
 support point. For subscription details see
 <http://www.squid-cache.org/Support/mailing-lists.html>.

 For reporting of non-security bugs in the latest STABLE release
 the squid bugzilla database should be used
 <http://bugs.squid-cache.org/>.

 For reporting of security sensitive bugs send an email to the
 squid-bugs at squid-cache.org mailing list. It's a closed list
 (though anyone can post) and security related bug reports are
 treated in confidence until the impact has been established.

__________________________________________________________________

Credits:

 The vulnerability was reported by Aleksandr Demchenko.

 Fixes by Alex Rousskov and Christos Tsantilas of The Measurement
 Factory.

__________________________________________________________________

Revision history:

 2015-08-27 08:39:03 GMT Initial Report
 2015-09-17 13:04:55 GMT Packages Released
__________________________________________________________________
END