[squid-users] splunk 3.5.27-Sec Advisories

[Kumpf, Scott]

Greetings,

The organization I work for is running Splunk for Windows version 3.5.27 which is impacted by 3 security vulnerabilities that were released earlier this year.  From what I can tell, our squid implementation was installed using an MSI package from Diladele.  It is my understanding per the advisories, the first point of contact for support is the maintainer/package vendor.  Diladele referred me back to Squid Developers and the only version that they have made available is version 3.5.27.  As I am not too familiar with source code packaging or compiling, I am in search for some guidance on available options to mitigate or remediate these vulnerabilities.  I believe 2 of them have workarounds that can be implemented by modifying the squid.conf.
As I  am not aware of how to determine how this version was configured at time of build therefore am not 100% certain if my implementation is even vulnerable.  Supposing the software is at risk, the advisories indicate there are patches available for each issue, however, I'm not clear on what to do with the information that the patch link presents.

The vulnerabilities are:
SQUID-2018:3 (CVE-2018-1172), Apr 18, 2018
Fixed from 4.0.13
Denial of Service issue in ESI Response processing.
SQUID-2018:2 (CVE-2018-1000027), Jan 19, 2018
Fixed from 4.0.23
Denial of Service issue in HTTP Response processing.
SQUID-2018:1 (CVE-2018-1000024), Jan 19, 2018
Fixed from 4.0.23
Denial of Service issue in ESI Response processing.

Any and all feedback, guidance, and assistance is greatly appreciated.

Thanks,

Scott

Scott Kumpf
Sr. Network Engineer (Contractor)
Orlando Utilities Commission
Office: (407) 434-4305 / Cell: (386) 547-2698
Email: skumpf at ouc.com





________________________________

DISCLAIMER:
Florida has a very broad public records law. As a result, any written communication created or received by Orlando Utilities Commission officials and employees will be made available to the public and media, upon request, unless otherwise exempt. Under Florida law, email addresses are public records. If you do not want your email address released in response to a public records request, do not send electronic mail to this office. Instead, contact our office by phone or in writing.