Denial of Service Vulnerability in Squid
Summary
CVE-2023-46847: Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. Affects squid across 2 version ranges.
>= 04c6f6c989fb0083b3b10adfe2f438b6781c43bd, < 1d8175b27fc1c347649d4f221ff2633e8d800429
< 6.4-r0
Fixed in 6.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely used caching proxy server that provides support for various protocols, including HTTP. It is designed to improve the performance and efficiency of web browsing by caching frequently accessed web content. However, Squid is vulnerable to a Denial of Service (DoS) attack when configured to accept HTTP Digest Authentication. This vulnerability allows a remote attacker to perform a buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory.
Vulnerability Detail
The vulnerability, identified as CVE-2023-46847, originates from a buffer overflow issue in Squid. When an attacker sends specially crafted HTTP Digest Authentication requests, they can exceed the allocated memory buffer, leading to a buffer overflow. This can result in the corruption of adjacent memory regions and potentially crash the Squid server. The impact of this vulnerability is a DoS condition, rendering the affected Squid server unavailable to legitimate users.
How To Fix
Minimum fixed version
6.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable HTTP Digest Authentication in their Squid configuration. By removing or commenting out the relevant configuration directives, the vulnerability can be mitigated. However, it is crucial to note that disabling HTTP Digest Authentication may impact the security and functionality of the Squid server, and it is recommended to apply the official fix as soon as possible.
Conclusion
In conclusion, Squid is vulnerable to a DoS attack when configured to accept HTTP Digest Authentication. This vulnerability can be mitigated by updating Squid to version 6.4-r0 or later. Alternatively, users can temporarily disable HTTP Digest Authentication as a workaround. It is important to prioritize the security of Squid installations and apply the necessary updates or workarounds to protect against this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for squid →
FAQ
Squid is a caching proxy server that improves web browsing performance by caching frequently accessed web content.
The vulnerability allows a remote attacker to perform a DoS attack, rendering the Squid server unavailable to legitimate users.
To fix this vulnerability, update Squid to version 6.4-r0 or later.
Yes, you can temporarily disable HTTP Digest Authentication in your Squid configuration as a workaround. However, it is recommended to apply the official fix as soon as possible.
You can obtain the latest version of Squid from the official Squid website or your distribution's package repository.
Related vulnerabilities
Recent vulnerabilities recorded for squid.
