Buffer overflow exposes unpatched Squid servers to RCE and DoS attacks

Some versions of the Squid web proxy cache server built with Basic Authentication features are affected by a heap buffer overflow vulnerability.

The heap buffer overflow security flaw, tracked as CVE-2019-12527, could be exploited by attackers to trigger DoS condition and also to execute arbitrary code on the vulnerable servers.

The flaw received a high severity CVSS v3.0 base score of 8.8 by, an attacker could be exploited by sending a specially crafted request to any targeted server.

The flaw affects Squid 4.0.23 through 4.7, the root couse is the incorrect buffer management. When checking Basic Authentication with HttpHeader::getAuth, the proxy cache server stores the decoded data in aglobal buffer. The problem is that Squid does not check that the decoded length isn’t greater than the buffer, triggering a heap-based buffer overflow.

“Due to incorrect buffer management Squid is vulnerable to a heap overflow and possible remote code execution attack when processing HTTP Authentication credentials.” reads the security advisory.

“This allows a malicious client to write a substantial amount of arbitrary data to the heap. Potentially gaining ability to execute arbitrary code. On systems with memory access protections this can result in the Squid process being terminated unexpectedly. Resulting in a denial of service for all clients using the proxy. This issue is limited to traffic accessing the Squid Cache Manager reports or using the FTP protocol gateway.”

Squid team pointed out that the problem is limited to the traffic accessing the Cache Manager reports or using the FTP protocol gateway.

Squid development team addressed the flaw with the release of Squid 4.8 on July 9.

The security advisory recommends the following workarounds for servers that can’t be patched:

Deny ftp:// protocol URLs being proxied and Cache Manager report access to all clients:

    acl FTP proto FTP
    http_access deny FTP
    http_access deny manager

Or,

 Build Squid with --disable-auth-basic

An interesting technical analysis of the vulnerability was published by Trend Micro on the website of the Zero-day initiative.

Pierluigi Paganini

(SecurityAffairs – proxy cache server, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]