Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 1334233 - (CVE-2016-4553, SQUID-2016:7) CVE-2016-4553 squid: Cache poisoning issue in HTTP Request handling
CVE-2016-4553 squid: Cache poisoning issue in HTTP Request handling
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20160506,repor...
: Security
Depends On: 1334251 1334506 1334507 1334508 1334509
Blocks: 1334247
  Show dependency treegraph
 
Reported: 2016-05-09 05:00 EDT by Andrej Nemec
Modified: 2016-08-24 19:24 EDT (History)
7 users (show)

See Also:
Fixed In Version: squid 3.5.18
Doc Type: Bug Fix
Doc Text:
An input validation flaw was found in the way Squid handled intercepted HTTP Request messages. An attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform cache poisoning attacks on Squid.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-06-09 08:43:19 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1139 normal SHIPPED_LIVE Moderate: squid security update 2016-05-31 05:42:41 EDT
Red Hat Product Errata RHSA-2016:1140 normal SHIPPED_LIVE Moderate: squid34 security update 2016-05-31 05:56:07 EDT

  None (edit)
Description Andrej Nemec 2016-05-09 05:00:32 EDT
Due to incorrect data validation of intercepted HTTP Request messages Squid is vulnerable to clients bypassing the protection against CVE-2009-0801 related issues. This leads to cache poisoning.

External references:

http://www.squid-cache.org/Advisories/SQUID-2016_7.txt

Upstream fix:

http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14039.patch
Comment 1 Andrej Nemec 2016-05-09 05:20:37 EDT
Created squid tracking bugs for this issue:

Affects: fedora-all [bug 1334251]
Comment 7 errata-xmlrpc 2016-05-31 01:43:11 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:1139 https://access.redhat.com/errata/RHSA-2016:1139
Comment 8 errata-xmlrpc 2016-05-31 01:56:54 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:1140 https://access.redhat.com/errata/RHSA-2016:1140
Comment 9 Fedora Update System 2016-07-12 16:27:46 EDT
squid-3.5.19-2.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2016-07-12 19:52:30 EDT
squid-3.5.10-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 11 Doran Moppert 2016-08-24 19:24:49 EDT
This issue has now been publicised as "Host of troubles" aka Cert VU#916855.  Red Hat products were patched in May and July, no further action is needed.

External URL:  https://hostoftroubles.com/

Note You need to log in before you can comment on or make changes to this bug.