Critical Memory Access Vulnerability in Squid Proxy Server
Summary
ALPINE-CVE-2020-8517: An issue was discovered in Squid before 4.10. Affects squid versions < 4.10-r0. Fixed in 4.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely used caching proxy for the web that supports HTTP, HTTPS, and FTP protocols. It is designed to improve web performance by caching frequently requested content and reducing bandwidth usage. Squid is known for its flexibility and extensibility, allowing users to configure various access controls and authentication methods. However, it is susceptible to vulnerabilities that can lead to service disruptions, especially in its authentication mechanisms.
Vulnerability Detail
An issue was discovered in Squid before version 4.10, where incorrect input validation in the NTLM authentication credentials parser within the ext_lm_group_acl can lead to memory being written outside the intended buffer. This flaw can cause the helper process to terminate unexpectedly, resulting in the Squid process also terminating. Consequently, this leads to a denial of service for all clients relying on the proxy, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
4.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling NTLM authentication if it is not essential for your operations. This can be done by modifying the Squid configuration file (usually located at /etc/squid/squid.conf) and commenting out or removing the NTLM authentication directives.
Conclusion
The vulnerability in Squid prior to version 4.10 poses a significant risk due to improper input validation in its NTLM authentication mechanism. Users are strongly advised to update to the patched version to ensure the security and stability of their proxy services. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for squid →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions of Squid prior to 4.10 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to a denial of service, causing the Squid proxy to terminate unexpectedly and disrupt service for all connected clients.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
