Squid Web Proxy up to 4.7 ESI Parser out-of-bounds write

Summaryinfo

A vulnerability marked as critical has been reported in Squid Web Proxy up to 4.7. This affects an unknown function of the component ESI Parser. The manipulation leads to out-of-bounds write. This vulnerability is traded as CVE-2019-12521. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Squid Web Proxy up to 4.7 (Firewall Software) and classified as critical. This issue affects an unknown code of the component ESI Parser. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.

The weakness was shared 04/15/2020. The identification of this vulnerability is CVE-2019-12521 since 06/02/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 04/16/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-153691, VDB-153690, VDB-153688 and VDB-153687 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Squid

Name

• Web Proxy

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7

License

• open-source

Website

• Vendor: http://www.squid-cache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion