__________________________________________________________________
Squid Proxy Cache Security Update Advisory SQUID-2020:2
__________________________________________________________________
Advisory ID: SQUID-2020:2
Date: February 02, 2020
Summary: Information Disclosure issue
in FTP Gateway.
Affected versions: Squid 2.x -> 2.7.STABLE9
Squid 3.x -> 3.5.28
Squid 4.x -> 4.9
Fixed in version: Squid 4.10
__________________________________________________________________
http://www.squid-cache.org/Advisories/SQUID-2020_2.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12528
__________________________________________________________________
Problem Description:
Due to incorrect data management Squid is vulnerable to a
information disclosure when translating FTP server listings
into HTTP responses.
__________________________________________________________________
Severity:
Certain FTP server responses can result in Squid revealing
random amounts of memory content from heap.
When Squid mempools feature is enabled the leak is limited to
lines in FTP directory listings, possibly from other clients.
When mempools is disabled the information may be anything from
the heap area including information from other processes on the
machine.
__________________________________________________________________
Updated Packages:
This bug is fixed by Squid version 4.10.
In addition, a patch addressing this problem for the stable
releases can be found in our patch archives:
Squid 3:
<http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-8cdb18ca1829a0b7faa1c9e472604ed0e7e105ac.patch>
Squid 4:
<http://www.squid-cache.org/Versions/v4/changesets/squid-4-c1bebac9c1135b7add6589db35c62f16db195b8f.patch>
If you are using a prepackaged version of Squid then please refer
to the package vendor for availability information on updated
packages.
__________________________________________________________________
Determining if your version is vulnerable:
All Squid-2.x up to and including 2.7.STABLE9 are vulnerable.
All Squid-3.x up to and including 3.5.28 are vulnerable.
All Squid-4.x up to and including 4.9 are vulnerable.
__________________________________________________________________
Workarounds:
* To disable FTP features
Remove from squid.conf:
acl Safe_ports 21
Add to squid.conf:
acl FTP proto FTP
http_access deny FTP
* To reduce leakage while retaining FTP features:
Remove from squid.conf:
memory_pools off
__________________________________________________________________
Contact details for the Squid project:
For installation / upgrade support on binary packaged versions
of Squid: Your first point of contact should be your binary
package vendor.
If your install and build Squid from the original Squid sources
then the squid-users at lists.squid-cache.org mailing list is your
primary support point. For subscription details see
<http://www.squid-cache.org/Support/mailing-lists.html>.
For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used
<http://bugs.squid-cache.org/>.
For reporting of security sensitive bugs send an email to the
squid-bugs at lists.squid-cache.org mailing list. It's a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.
__________________________________________________________________
Credits:
This vulnerability was discovered by Jeriko One
<jeriko.one at gmx.us>.
Fixed by Christos Tsantilas of The Measurement Factory.
__________________________________________________________________
Revision history:
2019-05-14 14:56:49 UTC Initial Report
2019-06-05 15:52:17 UTC CVE Assignment
2019-12-20 07:29:58 UTC Patches Released
__________________________________________________________________
END
_______________________________________________
squid-announce mailing list
squid-announce at lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-announce