__________________________________________________________________ Squid Proxy Cache Security Update Advisory SQUID-2019:9 __________________________________________________________________ Advisory ID: SQUID-2019:9 Date: November 05, 2019 Summary: Cross-Site Request Forgery issue in HTTP Request processing. Affected versions: Squid 2.x -> 2.7.STABLE9 Squid 3.x -> 3.5.28 Squid 4.x -> 4.8 Fixed in version: Squid 4.9 __________________________________________________________________ http://www.squid-cache.org/Advisories/SQUID-2019_9.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18677 __________________________________________________________________ Problem Description: Due to incorrect message processing Squid configured with append_domain can inappropriately redirect traffic to origins it should not be delivered to. __________________________________________________________________ Severity: This issue allows attackers to hide origin servers for phishing attacks or malware download URLs. This issue is restricted to proxies with append_domain configured. It is relatively easy for attackers to probe and determine whether a target network proxy has this directive along with its value. __________________________________________________________________ Updated Packages: This bug is fixed by Squid version 4.9. In addition, patches addressing this problem for the stable releases can be found in our patch archives: Squid 3.5: Squid 4: If you are using a prepackaged version of Squid then please refer to the package vendor for availability information on updated packages. __________________________________________________________________ Determining if your version is vulnerable: All Squid without append_domain configured are not vulnerable. All Squid-2.x up to and including 2.7.STABLE9 with append_domain configured are vulnerable. All Squid-3.x up to and including 3.5.28 with append_domain configured are vulnerable. All Squid-4.x up to and including 4.8 with append_domain configured are vulnerable. To determine whether append_domain is configured use the command: squid -k parse | grep append_domain __________________________________________________________________ Workarounds: Remove append_domain configuration settings from squid.conf. The append_domain feature is redundant when /etc/resolv.conf is used to determine hostnames. However, please note that use of /etc/resolv.conf may require removal of dns_nameservers and other redundant DNS directives. __________________________________________________________________ Contact details for the Squid project: For installation / upgrade support on binary packaged versions of Squid: Your first point of contact should be your binary package vendor. If your install and build Squid from the original Squid sources then the squid-users@lists.squid-cache.org mailing list is your primary support point. For subscription details see . For reporting of non-security bugs in the latest STABLE release the squid bugzilla database should be used . For reporting of security sensitive bugs send an email to the squid-bugs@lists.squid-cache.org mailing list. It's a closed list (though anyone can post) and security related bug reports are treated in confidence until the impact has been established. __________________________________________________________________ Credits: This vulnerability was discovered by Kristoffer Danielsson. Fixed by Amos Jeffries of Treehouse Networks Ltd. __________________________________________________________________ Revision history: 2019-06-26 21:43:49 UTC Initial Report 2019-07-12 03:08:00 UTC Patches Released 2019-11-04 13:43:22 UTC CVE-2019-18677 Assignment __________________________________________________________________ END