__________________________________________________________________

    Squid Proxy Cache Security Update Advisory SQUID-2012:1
__________________________________________________________________

Advisory ID:            SQUID-2012:1
Date:                   December 17, 2012
Summary:                Denial of service in cachemgr.cgi
Affected versions:      Squid 2.x all releases
                        Squid 3.0 all releases
                        Squid 3.1 -> 3.1.22
                        Squid 3.2 -> 3.2.5
                        Squid 3.3 -> 3.3.0.2
Fixed in version:       Squid 3.3.0.3, 3.2.6, 3.1.23
__________________________________________________________________

    http://www.squid-cache.org/Advisories/SQUID-2012_1.txt
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5643
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0189
__________________________________________________________________

Problem Description:

 Due to missing input validation Squid cachemgr.cgi tool is
 vulnerable to a denial of service attack when processing
 specially crafted requests.

__________________________________________________________________

Severity:

 This problem allows any client able to reach the cachemgr.cgi
 to perform a denial of service attack on the service host.

 The nature of the attack may cause secondary effects through
 resource consumption on the host server.

__________________________________________________________________

Updated Packages:

 This bug is fixed by Squid versions 3.2.6 and 3.3.0.3

 In addition, patches addressing this problem for stable releases
 can be found in our patch archives:

Squid 2.7:
http://www.squid-cache.org/Versions/v2/2.7/changesets/SQUID-2012_1.patch

Squid 3.1:
http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID-2012_1.patch

Squid 3.2:
http://www.squid-cache.org/Versions/v3/3.2/changesets/SQUID-2012_1.patch

 If you are using a prepackaged version of Squid then please refer
 to the package vendor for availability information on updated
 packages.

__________________________________________________________________

Determining if your version is vulnerable:

 Squid proxy is not vulnerable. The problem is isolated to the
 manager CGI interface tool.


 cachemgr.cgi tool displays its version number in the HTML pages
 with a version number:

  All 2.x versions up to and including 2.7.STABLE9 are vulnerable.

  All 3.x versions up to and including 3.1.22 are vulnerable.

  All 3.2 versions up to and including 3.2.5 are vulnerable.

  All 3.3 beta versions up to and including 3.3.0.2 are vulnerable.

  All 3.x versions newer than the above are not vulnerable.

__________________________________________________________________

Workaround:

 Add access controls to the host web server limiting which clients
 can send requests to the CGI tool.

or,

 Add server limits to CGI process memory consumption to the
 host web server running cachemgr.cgi.


__________________________________________________________________

Contact details for the Squid project:

 For installation / upgrade support on binary packaged versions
 of Squid: Your first point of contact should be your binary
 package vendor.

 If you install and build Squid from the original Squid sources
 then thesquid-users@squid-cache.org  mailing list is your primary
 support point. For subscription details see
 http://www.squid-cache.org/Support/mailing-lists.html.

 For reporting of non-security bugs in the latest release
 the squid bugzilla database should be used
 http://bugs.squid-cache.org/.

 For reporting of security sensitive bugs send an email to the
 squid-bugs@squid-cache.org  mailing list. It's a closed list
 (though anyone can post) and security related bug reports are
 treated in confidence until the impact has been established.

__________________________________________________________________

Credits:

 The vulnerability was discovered by Coverity Scan Project.

 Additional flaws discovered by Seth Arnold, Cannocal Ltd. and
 Saran Neti, TELUS Security Labs and Eygene Ryabinkin, FreeBSD.

__________________________________________________________________

Revision history:

 2012-10-29 12:47 --- Initial Detection
 2012-11-15 03:05 GMT Patches Released
 2012-12-17 06:20 GMT Advisory Released
 2012-12-18 22:17 GMT Additional flaw identified
 2012-12-21 21:38 GMT Additional flaw identified
 2013-01-01 06:50 GMT Updated patches and advisory released
 2013-01-09 02:50 GMT Updated packages released
 2013-01-21 00:00 GMT Squid-2.7 patch released
 2013-03-08 00:39 GMT Updated CVE references
__________________________________________________________________
END