Heap-Based Buffer Overflow in Squid: CVE-2019-12526
Summary
CVE-2019-12526: An issue was discovered in Squid before 4.9. Affects squid across 3 version ranges.
< 4.9-1
< 6cfeb300caf423ff49a0511d8bd43a56f3418273
< fede82b3e7aa1f12a91bade17f6ac0d4c7463e0a
Fixed in 4.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely-used caching proxy for the web that supports HTTP, HTTPS, FTP, and more. It is designed to improve web performance by caching frequently requested content and reducing bandwidth usage. However, prior to version 4.9, Squid is vulnerable to a heap-based buffer overflow due to improper handling of URN responses, which can lead to severe security risks.
Vulnerability Detail
CVE-2019-12526 is a critical vulnerability in Squid that arises from its handling of URN response data. When Squid receives data from a remote server in response to a URN request, it does not adequately check if the incoming data fits within the allocated buffer. This oversight allows an attacker to send specially crafted data that can overflow the buffer, leading to potential arbitrary code execution, data corruption, or denial of service. The vulnerability has a CVSS score of 9.8, indicating its high severity and potential impact on affected systems.
How To Fix
Minimum fixed version
4.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider disabling URN requests or restricting access to the Squid proxy to trusted users only. This can help mitigate the risk until a proper fix is applied.
Conclusion
CVE-2019-12526 is a significant vulnerability in Squid that poses serious security risks due to a heap-based buffer overflow. Users are strongly advised to upgrade to the latest version to protect their systems from potential exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for squid →
FAQ
CVE-2019-12526 is a vulnerability in Squid that allows for a heap-based buffer overflow due to improper handling of URN responses.
Exploitation of this vulnerability can lead to arbitrary code execution, data corruption, or denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The recommended action is to upgrade Squid to version 4.9-1 or later to mitigate the vulnerability.
Yes, temporarily disable URN requests or restrict access to the Squid proxy until an upgrade can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for squid.
