Critical Vulnerability in Squid Package: Memory Corruption via Digest Authentication
Summary
ALPINE-CVE-2019-12525: An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. Affects squid versions < 4.8-r0. Fixed in 4.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely used caching proxy for the web that supports various protocols, including HTTP, HTTPS, and FTP. It is designed to improve web performance by caching frequently requested content and reducing bandwidth usage. Squid's functionality includes access control, authentication, and logging. However, certain versions of Squid are vulnerable to a memory corruption issue when configured to use Digest authentication, which can lead to severe security risks.
Vulnerability Detail
An issue was discovered in Squid versions 3.3.9 through 3.5.28 and 4.x through 4.7. When configured for Digest authentication, Squid improperly parses the Proxy-Authorization header. It checks if specific tokens start and end with quotes but fails to validate if the value is a single quote. This oversight allows a memcpy operation that can lead to memory corruption, potentially allowing attackers to execute arbitrary code or crash the service.
How To Fix
Minimum fixed version
4.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling Digest authentication in your Squid configuration until the package can be updated. This can be done by modifying the squid.conf file to remove or comment out the relevant authentication directives.
Conclusion
The vulnerability in Squid poses a significant risk due to improper handling of the Proxy-Authorization header during Digest authentication. It is crucial to update to the patched version to mitigate potential security threats. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for squid →
FAQ
Squid versions 3.3.9 through 3.5.28 and 4.x through 4.7 are affected by this vulnerability.
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to memory corruption, allowing attackers to execute arbitrary code or crash the Squid service.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
