Security update for squid SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2008-1 Final 1 1 2016-08-09T11:32:29Z current 2016-08-09T11:32:29Z 2016-08-09T11:32:29Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for squid The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues: - Fixed multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395) - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782) - CVE-2015-5400: Improper protection of alternate path. (bsc#938715) - CVE-2015-3455: Squid http proxy configured with client-first SSL bumping did not correctly validate server certificate. (bsc#929493) - CVE-2016-3948: Fixed denial of service in HTTP Response processing (bsc#973783) - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553) - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: Fixed multiple issues in ESI processing (bsc#976556) - CVE-2016-4553: Fixed cache poisoning issue in HTTP Request handling (bsc#979009) - CVE-2016-4554: Fixed header smuggling issue in HTTP Request processing (bsc#979010) - Fixed multiple Denial of Service issues in ESI Response processing. (CVE-2016-4555, CVE-2016-4556, bsc#979011, bsc#979008) Additionally, the following non-security issues have been fixed: - Fix header size in script unsquid.pl. (bsc#902197) - Add external helper ext_session_acl to package. (bsc#959290) - Update forward_max_tries to permit 25 server paths With cloud sites becoming more popular more CDN servers are producing long lists of IPv6 and IPv4 addresses. If there are not enough paths selected the IPv4 ones may never be reached. - squid.init: wait that squid really dies when we kill it on upgrade instead of proclaiming its demise prematurely (bnc#963539) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-SERVER-12-SP1-2016-1184 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ Link for SUSE-SU-2016:2008-1 https://lists.suse.com/pipermail/sle-security-updates/2016-August/002194.html E-Mail link for SUSE-SU-2016:2008-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/902197 SUSE Bug 902197 https://bugzilla.suse.com/929493 SUSE Bug 929493 https://bugzilla.suse.com/938715 SUSE Bug 938715 https://bugzilla.suse.com/955783 SUSE Bug 955783 https://bugzilla.suse.com/959290 SUSE Bug 959290 https://bugzilla.suse.com/963539 SUSE Bug 963539 https://bugzilla.suse.com/968392 SUSE Bug 968392 https://bugzilla.suse.com/968393 SUSE Bug 968393 https://bugzilla.suse.com/968394 SUSE Bug 968394 https://bugzilla.suse.com/968395 SUSE Bug 968395 https://bugzilla.suse.com/973782 SUSE Bug 973782 https://bugzilla.suse.com/973783 SUSE Bug 973783 https://bugzilla.suse.com/976553 SUSE Bug 976553 https://bugzilla.suse.com/976556 SUSE Bug 976556 https://bugzilla.suse.com/979008 SUSE Bug 979008 https://bugzilla.suse.com/979009 SUSE Bug 979009 https://bugzilla.suse.com/979010 SUSE Bug 979010 https://bugzilla.suse.com/979011 SUSE Bug 979011 https://www.suse.com/security/cve/CVE-2015-3455/ SUSE CVE CVE-2015-3455 page https://www.suse.com/security/cve/CVE-2015-5400/ SUSE CVE CVE-2015-5400 page https://www.suse.com/security/cve/CVE-2016-2569/ SUSE CVE CVE-2016-2569 page https://www.suse.com/security/cve/CVE-2016-2570/ SUSE CVE CVE-2016-2570 page https://www.suse.com/security/cve/CVE-2016-2571/ SUSE CVE CVE-2016-2571 page https://www.suse.com/security/cve/CVE-2016-2572/ SUSE CVE CVE-2016-2572 page https://www.suse.com/security/cve/CVE-2016-3947/ SUSE CVE CVE-2016-3947 page https://www.suse.com/security/cve/CVE-2016-3948/ SUSE CVE CVE-2016-3948 page https://www.suse.com/security/cve/CVE-2016-4051/ SUSE CVE CVE-2016-4051 page https://www.suse.com/security/cve/CVE-2016-4052/ SUSE CVE CVE-2016-4052 page https://www.suse.com/security/cve/CVE-2016-4053/ SUSE CVE CVE-2016-4053 page https://www.suse.com/security/cve/CVE-2016-4054/ SUSE CVE CVE-2016-4054 page https://www.suse.com/security/cve/CVE-2016-4553/ SUSE CVE CVE-2016-4553 page https://www.suse.com/security/cve/CVE-2016-4554/ SUSE CVE CVE-2016-4554 page https://www.suse.com/security/cve/CVE-2016-4555/ SUSE CVE CVE-2016-4555 page https://www.suse.com/security/cve/CVE-2016-4556/ SUSE CVE CVE-2016-4556 page SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1 squid-3.3.14-20.2 squid-3.3.14-20.2 as a component of SUSE Linux Enterprise Server 12 SP1 squid-3.3.14-20.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate. CVE-2015-3455 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2015-3455.html CVE-2015-3455 https://bugzilla.suse.com/929493 SUSE Bug 929493 Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request. CVE-2015-5400 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2015-5400.html CVE-2015-5400 https://bugzilla.suse.com/938715 SUSE Bug 938715 https://bugzilla.suse.com/967073 SUSE Bug 967073 Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header. CVE-2016-2569 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-2569.html CVE-2016-2569 https://bugzilla.suse.com/968392 SUSE Bug 968392 https://bugzilla.suse.com/968393 SUSE Bug 968393 The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h. CVE-2016-2570 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-2570.html CVE-2016-2570 https://bugzilla.suse.com/968392 SUSE Bug 968392 https://bugzilla.suse.com/968393 SUSE Bug 968393 http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. CVE-2016-2571 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-2571.html CVE-2016-2571 https://bugzilla.suse.com/968394 SUSE Bug 968394 https://bugzilla.suse.com/968395 SUSE Bug 968395 http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. CVE-2016-2572 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-2572.html CVE-2016-2572 https://bugzilla.suse.com/968394 SUSE Bug 968394 https://bugzilla.suse.com/968395 SUSE Bug 968395 Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet. CVE-2016-3947 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-3947.html CVE-2016-3947 https://bugzilla.suse.com/973782 SUSE Bug 973782 Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers. CVE-2016-3948 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 2.9 AV:A/AC:M/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-3948.html CVE-2016-3948 https://bugzilla.suse.com/973783 SUSE Bug 973783 Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data. CVE-2016-4051 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-4051.html CVE-2016-4051 https://bugzilla.suse.com/976553 SUSE Bug 976553 Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVE-2016-4052 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-4052.html CVE-2016-4052 https://bugzilla.suse.com/976556 SUSE Bug 976556 Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization. CVE-2016-4053 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-4053.html CVE-2016-4053 https://bugzilla.suse.com/976556 SUSE Bug 976556 Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVE-2016-4054 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-4054.html CVE-2016-4054 https://bugzilla.suse.com/976556 SUSE Bug 976556 client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request. CVE-2016-4553 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-4553.html CVE-2016-4553 https://bugzilla.suse.com/979009 SUSE Bug 979009 https://bugzilla.suse.com/990451 SUSE Bug 990451 mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue. CVE-2016-4554 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-4554.html CVE-2016-4554 https://bugzilla.suse.com/979010 SUSE Bug 979010 https://bugzilla.suse.com/990451 SUSE Bug 990451 client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses. CVE-2016-4555 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 6 AV:N/AC:M/Au:S/C:P/I:P/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-4555.html CVE-2016-4555 https://bugzilla.suse.com/979008 SUSE Bug 979008 https://bugzilla.suse.com/979011 SUSE Bug 979011 Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response. CVE-2016-4556 SUSE Linux Enterprise Server 12 SP1:squid-3.3.14-20.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:squid-3.3.14-20.2 moderate 6 AV:N/AC:M/Au:S/C:P/I:P/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/ https://www.suse.com/security/cve/CVE-2016-4556.html CVE-2016-4556 https://bugzilla.suse.com/979008 SUSE Bug 979008 https://bugzilla.suse.com/979011 SUSE Bug 979011