CVE-2018-1000027

The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later.

The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later.

• CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
• CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
• CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
• CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
• CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
• CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
• CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
• CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
• CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
• CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
• CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
• CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
• CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation

• CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
• CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
• CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
• CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
• CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
• CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
• CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
• CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
• CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
• CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
• CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
• CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
• CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation

• CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
• CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
• CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
• CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
• CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
• CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
• CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
• CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
• CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
• CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads

• CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
• CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
• CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
• CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
• CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
• CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
• CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
• CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
• CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
• CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

This update for squid fixes the following issues:

Security issues fixed:

• CVE-2018-1000024: DoS fix caused by incorrect pointer handling when processing ESI responses. This affects the default custom esi_parser (bsc#1077003).
• CVE-2018-1000027: DoS fix caused by incorrect pointer handing whien processing ESI responses or downloading intermediate CA certificates (bsc#1077006).

This update for squid3 fixes the following issues:

Security issues fixed:

• CVE-2018-1000024: DoS fix caused by incorrect pointer handling when processing ESI responses. This affects the default custom esi_parser (bsc#1077003).
• CVE-2018-1000027: DoS fix caused by incorrect pointer handing whien processing ESI responses or downloading intermediate CA certificates (bsc#1077006).

Mathias Fischer discovered that Squid incorrectly handled certain long strings in headers. A malicious remote server could possibly cause Squid to crash, resulting in a denial of service. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2016-2569)

William Lima discovered that Squid incorrectly handled XML parsing when processing Edge Side Includes (ESI). A malicious remote server could possibly cause Squid to crash, resulting in a denial of service. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2016-2570)

Alex Rousskov discovered that Squid incorrectly handled response-parsing failures. A malicious remote server could possibly cause Squid to crash, resulting in a denial of service. This issue only applied to Ubuntu 16.04 LTS. (CVE-2016-2571)

Santiago Ruano Rincón discovered that Squid incorrectly handled certain Vary headers. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2016-3948)

Louis Dion-Marcil discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A malicious remote server could possibly cause Squid to crash, resulting in a denial of service. (CVE-2018-1000024)

Louis Dion-Marcil discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A malicious remote server could possibly cause Squid to crash, resulting in a denial of service. (CVE-2018-1000027)