[squid-announce] [ADVISORY] SQUID-2016:7 Cache poisoning issue in HTTP Request handling

[Amos Jeffries]

__________________________________________________________________

    Squid Proxy Cache Security Update Advisory SQUID-2016:7
__________________________________________________________________

Advisory ID:        SQUID-2016:7
Date:               May 06, 2016
Summary:            Cache poisoning issue
                    in HTTP Request handling
Affected versions:  Squid 3.2.0.11 -> 3.5.17
                    Squid 4.x -> 4.0.9
Fixed in version:   Squid 3.5.18, 4.0.10
__________________________________________________________________

    http://www.squid-cache.org/Advisories/SQUID-2016_7.txt
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4553
__________________________________________________________________

Problem Description:

 Due to incorrect data validation of intercepted HTTP Request
 messages Squid is vulnerable to clients bypassing the protection
 against CVE-2009-0801 related issues. This leads to cache
 poisoning.

__________________________________________________________________

Severity:

 This problem is serious because it allows any client, including
 browser scripts, to bypass local security and poison the proxy
 cache and any downstream caches with content from an arbitrary
 source.

__________________________________________________________________

Updated Packages:

 This bug is fixed by Squid version 3.5.18 and 4.0.10.

 In addition, a patch addressing this problem for the stable
 release can be found in our patch archives:

Squid 3.5:
 <http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14039.patch>

 If you are using a prepackaged version of Squid then please refer
 to the package vendor for availability information on updated
 packages.

__________________________________________________________________

Determining if your version is vulnerable:

Use the command 'squid -v' to view version and build details of
your proxy;

 All Squid 2.x are not vulnerable.

 All Squid-3.x up to and including 3.2.0.10 are not vulnerable.

 All Squid-3.2.0.11 and later versions up to and including 3.5.17
 are vulnerable.

 All Squid-4.x up to and including 4.0.9 are vulnerable.

__________________________________________________________________

Workaround:

 Add to squid.conf:
   client_dst_passthru off

And,

 Remove any use of "host_verify_strict" directive.

__________________________________________________________________

Contact details for the Squid project:

 For installation / upgrade support on binary packaged versions
 of Squid: Your first point of contact should be your binary
 package vendor.

 If you install and build Squid from the original Squid sources
 then the squid-users at squid-cache.org mailing list is your
 primary support point. For subscription details see
 http://www.squid-cache.org/Support/mailing-lists.html.

 For reporting of non-security bugs in the latest release
 the squid bugzilla database should be used
 http://bugs.squid-cache.org/.

 For reporting of security sensitive bugs send an email to the
 squid-bugs at squid-cache.org mailing list. It is a closed list
 (though anyone can post) and security related bug reports are
 treated in confidence until the impact has been established.

__________________________________________________________________

Credits:

 The vulnerability was reported by Jianjun Chen from Tsinghua
 University.

 Fixed by Amos Jeffries from Treehouse Networks Ltd.

__________________________________________________________________

Revision history:

 2016-04-15 10:54:39 UTC Initial Report
 2016-05-02 10:51:18 UTC Patch Released
 2016-05-06 13:12:00 UTC Packages Released
 2016-05-06 14:46:41 UTC CVE Assignment
__________________________________________________________________
END