The heap buffer overflow security flaw, tracked as CVE-2019-12527, could be exploited by attackers to trigger
The flaw received a high severity CVSS v3
The flaw affects Squid 4.0.23 through 4.7, the root
“Due to incorrect buffer management Squid is vulnerable to a heap overflow and possible remote code execution attack when processing HTTP Authentication credentials.” reads the security advisory.
“This allows a malicious client to write a substantial amount of arbitrary data to the heap. Potentially gaining ability to execute arbitrary code. On systems with memory access protections this can result in the Squid process being terminated unexpectedly. Resulting in a denial of service for all clients using the proxy. This issue is limited to traffic accessing the Squid Cache Manager reports or using the FTP protocol gateway.”
Squid team pointed out that the problem is limited to the traffic accessing the Cache Manager reports or using the FTP protocol gateway.
Squid development team addressed the flaw with the release of Squid 4.8 on July 9.
The security advisory recommends the following workarounds for servers that can’t be patched:
Deny ftp:// protocol URLs being proxied and Cache Manager report access to all clients:
acl FTP proto FTP
http_access deny FTP
http_access deny manager
BuildSquid with --disable- auth-basic
An interesting technical analysis of the vulnerability was published by Trend Micro on the website of the Zero-day initiative.