__________________________________________________________________ Squid Proxy Cache Security Update Advisory SQUID-2020:4 __________________________________________________________________ Advisory ID: SQUID-2020:4 Date: April 23, 2020 Summary: Multiple issues in HTTP Digest authentication. Affected versions: Squid 2.x -> 2.7.STABLE9 Squid 3.x -> 3.5.28 Squid 4.x -> 4.10 Squid 5.x -> 5.0.1 Fixed in version: Squid 4.11 and 5.0.2 __________________________________________________________________ http://www.squid-cache.org/Advisories/SQUID-2020_4.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11945 __________________________________________________________________ Problem Description: Due to an integer overflow bug Squid is vulnerable to credential replay and remote code execution attacks against HTTP Digest Authentication tokens. __________________________________________________________________ Severity: When memory pooling is used this problem allows a remote client to replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. When memory pooling is disabled this problem allows a remote client to perform remote code execution through the free'd nonce credentials. __________________________________________________________________ Updated Packages: This bug is fixed by Squid versions 4.11 and 5.0.2. In addition, patches addressing this problem for the stable releases can be found in our patch archives: Squid 4: If you are using a prepackaged version of Squid then please refer to the package vendor for availability information on updated packages. __________________________________________________________________ Determining if your version is vulnerable: All Squid-2.x up to and including 2.4.STABLE7 are not vulnerable. All Squid-2.5 up to and including 2.7.STABLE9 are vulnerable. All Squid-2.x up to and including 2.7.STABLE9 configured with "auth_param digest" are vulnerable. All Squid-2.x up to and including 2.7.STABLE9 configured without "auth_param digest" are not vulnerable. All Squid-3.x up to and including 3.5.28 built with --disable-auth are not vulnerable. All Squid-3.2 up to and including 3.5.28 built with --disable-auth-digest are not vulnerable. All Squid-3.x up to and including 3.5.28 configured with "auth_param digest" are vulnerable. All Squid-3.x up to and including 3.5.28 configured without "auth_param digest" are not vulnerable. All Squid-4.x up to and including 4.10 built with --disable-auth are not vulnerable. All Squid-4.x up to and including 4.10 built with --disable-auth-digest are not vulnerable. All Squid-4.x up to and including 4.10 configured with "auth_param digest" are vulnerable. All Squid-4.x up to and including 4.10 configured without "auth_param digest" are not vulnerable. Squid-5.0.1 built with --disable-auth-digest is not vulnerable. Squid-5.0.1 configured with "auth_param digest" are vulnerable. Squid-5.0.1 configured without "auth_param digest" are not vulnerable. __________________________________________________________________ Workaround: Either, Remove all "auth_param digest" lines from squid.conf Or, Build Squid with --disable-auth-digest Or, Build Squid with --disable-auth __________________________________________________________________ Contact details for the Squid project: For installation / upgrade support on binary packaged versions of Squid: Your first point of contact should be your binary package vendor. If your install and build Squid from the original Squid sources then the squid-users@lists.squid-cache.org mailing list is your primary support point. For subscription details see . For reporting of non-security bugs in the latest STABLE release the squid bugzilla database should be used . For reporting of security sensitive bugs send an email to the squid-bugs@lists.squid-cache.org mailing list. It's a closed list (though anyone can post) and security related bug reports are treated in confidence until the impact has been established. __________________________________________________________________ Credits: This vulnerability was discovered by Clément Berthaux and Florian Guilbert of Synacktiv. Fixed by Maxime Desbrus of Synacktiv. __________________________________________________________________ Revision history: 2019-11-20 13:39:07 UTC Initial Report 2020-04-02 11:16:45 UTC Patches Released 2020-04-20 20:08:14 UTC CVE Assignment 2020-04-23 08:00:00 UTC Advisory Released __________________________________________________________________ END