Squid Web Proxy up to 4.7 ESI ESIExpression::Evaluate out-of-bounds write

Summaryinfo

A vulnerability identified as critical has been detected in Squid Web Proxy up to 4.7. The affected element is the function ESIExpression::Evaluate of the component ESI. Performing a manipulation results in out-of-bounds write. This vulnerability is reported as CVE-2019-12519. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in Squid Web Proxy up to 4.7 (Firewall Software). This affects the function ESIExpression::Evaluate of the component ESI. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow.

The weakness was disclosed 04/15/2020. This vulnerability is uniquely identified as CVE-2019-12519 since 06/02/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 04/16/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-153691, VDB-153690, VDB-153689 and VDB-153688 are pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Squid

Name

• Web Proxy

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7

License

• open-source

Website

• Vendor: http://www.squid-cache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion