Junglewise Threat Intelligence

CVE-2016-10002: Squid HTTP Proxy information disclosure via HTTP conditional requests

CVE-2016-10002 · Severity: high · CVSS 7.5 · Published 2017-01-27

Technologies: Debian Linux. Vendors: Debian.

Executive brief

A vulnerability in the Squid HTTP Proxy, a tool used to speed up web browsing and filter internet traffic, could allow an attacker to steal private information. By sending specifically crafted requests, an attacker can trick the proxy into revealing sensitive data, such as login cookies, belonging to other users on the network. This could lead to unauthorized account access or the exposure of private user sessions.

Technical details

An information disclosure vulnerability exists in Squid HTTP Proxy due to the incorrect processing of responses to 'If-None-Modified' HTTP conditional requests. The root cause is the failure to properly remove connection-specific headers when serving a response from the cache. A remote, unauthenticated attacker can craft specific HTTP requests to probe the cache and retrieve sensitive 'Set-Cookie' or other private header data belonging to different client sessions. This affects versions 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16. Patches are available from the vendor and various Linux distributions.

Affected products

  • Squid-Cache Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, 4.0.1 through 4.0.16

Timeline

  • 2016-12-18: disclosed: Initial public disclosure on oss-security mailing list
  • 2017-01-24: patched: Red Hat released security updates for RHEL 6 and 7
  • 2017-01-27: advisory: NVD published the CVE record

References

Related threats