CVE-2016-2390 in Squid
Summary
by MITRE
The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/08/2022
The vulnerability described in CVE-2016-2390 affects the Squid proxy server software, specifically impacting versions prior to 3.5.14 and 4.0.x before 4.0.6. This issue resides within the FwdState::connectedToPeer method implementation in the Squid source code file FwdState.cc. The flaw manifests when Squid is compiled with the --with-openssl option, creating a specific condition where SSL handshake errors are not properly managed during the proxy connection establishment process.
The technical nature of this vulnerability stems from improper error handling during SSL/TLS connection establishment between the Squid proxy and upstream servers. When a client sends a plaintext HTTP message to a Squid server configured with OpenSSL support, the system fails to correctly process SSL handshake failures. This mismanagement occurs during the FwdState::connectedToPeer method execution, which is responsible for establishing connections to peer servers in the proxy chain. The improper handling results in an application crash rather than graceful error recovery or connection termination.
The operational impact of this vulnerability is significant as it enables remote attackers to execute a denial of service attack against Squid proxy servers. An attacker can send a carefully crafted plaintext HTTP message to the vulnerable Squid instance, triggering the SSL handshake error condition that leads to application crash and subsequent service unavailability. This attack vector is particularly dangerous because it requires no authentication or privileged access, making it accessible to any remote party capable of reaching the proxy server. The vulnerability essentially allows an attacker to disrupt legitimate proxy services and potentially impact downstream network operations that depend on the proxy infrastructure.
This vulnerability aligns with CWE-248, which addresses "Uncaught Exception" conditions in software implementations. The improper SSL error handling represents a classic case where an exception or error condition is not properly caught and managed, leading to application termination. From an ATT&CK framework perspective, this vulnerability maps to T1499.004, which covers "Endpoint Denial of Service," and potentially T1595.001 for "Network Denial of Service" as the attack can disrupt proxy services. The attack requires minimal resources and can be executed remotely, making it a preferred vector for service disruption attacks against proxy infrastructure.
Mitigation strategies for this vulnerability involve upgrading to Squid versions 3.5.14 or 4.0.6 and later, which contain the necessary code fixes to properly handle SSL handshake errors. Organizations should also implement network-level protections such as firewall rules that limit access to proxy services, monitoring for unusual traffic patterns that might indicate exploitation attempts, and ensuring that proxy servers are properly configured to avoid unnecessary exposure. Additionally, administrators should regularly update their proxy software to address known vulnerabilities and maintain current security patches to prevent similar issues from compromising their network infrastructure.