Be in love with vulnerability scanning

Mageni is a free and open-source vulnerability scanning and management platform used by companies of all sizes. You will be in love with Mageni's powerful features and ease of use. Mageni automates the vulnerability scanning process and saves you time, resources, and money. No registration or credit card is required.

Download Now
App screenshot

Debian Security Advisory DSA 3625-1 (squid3 - security update)

Information

Severity

Severity

Medium

Family

Family

Debian Local Security Checks

CVSSv2 Base

CVSSv2 Base

6.8

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Solution Type

Solution Type

Vendor Patch

Created

Created

5 years ago

Modified

Modified

7 months ago

Summary

Several security issues have been discovered in the Squid caching proxy. CVE-2016-4051: CESG and Yuriy M. Kaminskiy discovered that Squid cachemgr.cgi was vulnerable to a buffer overflow when processing remotely supplied inputs relayed through Squid. CVE-2016-4052: CESG discovered that a buffer overflow made Squid vulnerable to a Denial of Service (DoS) attack when processing ESI responses. CVE-2016-4053: CESG found that Squid was vulnerable to public information disclosure of the server stack layout when processing ESI responses. CVE-2016-4054: CESG discovered that Squid was vulnerable to remote code execution when processing ESI responses. CVE-2016-4554: Jianjun Chen found that Squid was vulnerable to a header smuggling attack that could lead to cache poisoning and to bypass of same-origin security policy in Squid and some client browsers. CVE-2016-4555, CVE-2016-4556: 'bfek-18' and '@vftable' found that Squid was vulnerable to a Denial of Service (DoS) attack when processing ESI responses, due to incorrect pointer handling and reference counting.

Affected Software

Affected Software

squid3 on Debian Linux

Detection Method

Detection Method

This check tests the installed software version using the apt package manager.

Solution

Solution

For the stable distribution (jessie), these problems have been fixed in version 3.4.8-6+deb8u3. For the testing (stretch) and unstable (sid) distributions, these problems have been fixed in version 3.5.19-1. We recommend that you upgrade your squid3 packages.

Take the next step.

Take the next step and download Mageni Vulnerability Scanner

Mageni automates the vulnerability scanning process saving you time, resources, and money. No registration or credit card is required. It is free and always will be.

1. Download Multipass

sudo snap install multipass

2. Launch a multipass instance

multipass launch -c 2 -m 6G -d 20G -n mageni 20.04 && multipass shell mageni

3. Install Mageni

curl -sL https://www.mageni.net/installation | sudo bash

1. If you don’t have it already, install Brew. Then, to install Multipass simply execute:

brew install --cask multipass

2. Launch a multipass instance

multipass launch -c 2 -m 6G -d 20G -n mageni 20.04 && multipass shell mageni

2. Install Mageni

curl -sL https://www.mageni.net/installation | sudo bash

1. Download the installer for Windows

Note: You need Windows 10 Pro/Enterprise/Education v 1803 or later, or any Windows 10 with VirtualBox

2. Ensure your network is private

Make sure your local network is designated as private, otherwise Windows prevents Multipass from starting.

3. Run the installer

You need to allow the installer to gain Administrator privileges.

4. Launch a multipass instance

multipass launch -c 2 -m 6G -d 20G -n mageni 20.04 && multipass shell mageni

5. Install Mageni

curl -sL https://www.mageni.net/installation | sudo bash