CVE-2019-18676

Se descubrió un problema en Squid versiones 2.x, 3.x y versiones 4.x hasta 4.8. Debido a una comprobación de entrada incorrecta, hay un desbordamiento del búfer en la región heap de la memoria que puede resultar en una Denegación de Servicio a todos los clientes que usan el proxy. La gravedad es alta debido a que esta vulnerabilidad ocurre antes de las comprobaciones de seguridad normales; cualquier cliente remoto que pueda alcanzar el puerto proxy puede realizar trivialmente el ataque por medio de un esquema de URI especialmente diseñado.

USN-4446-1 fixed vulnerabilities in Squid. The update introduced a regression when using Squid with the icap or ecap protocols. This update fixes the problem. Jeriko One discovered that Squid incorrectly handled caching certain requests. A remote attacker could possibly use this issue to perform cache-injection attacks or gain access to reverse proxy features such as ESI. Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled certain URN requests. A remote attacker could possibly use this issue to bypass access checks. Jeriko One discovered that Squid incorrectly handled URL decoding. A remote attacker could possibly use this issue to bypass certain rule checks. Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled input validation. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service. Various other issues were also addressed.