Test ID:	1.3.6.1.4.1.25623.1.0.882499
Category:	CentOS Local Security Checks
Title:	CentOS Update for squid CESA-2016:1139 centos7
Summary:	Check the version of squid
Description:	Summary: Check the version of squid Vulnerability Insight: Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code. (CVE-2016-4051) * Buffer overflow and input validation flaws were found in the way Squid processed ESI responses. If Squid was used as a reverse proxy, or for TLS/HTTPS interception, a remote attacker able to control ESI components on an HTTP server could use these flaws to crash Squid, disclose parts of the stack memory, or possibly execute arbitrary code as the user running Squid. (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054) * An input validation flaw was found in the way Squid handled intercepted HTTP Request messages. An attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform cache poisoning attacks on Squid. (CVE-2016-4553) * An input validation flaw was found in Squid's mime_get_header_field() function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid operating as interception or reverse-proxy to contact the wrong origin server. It could also be used for cache poisoning for client not following RFC 7230. (CVE-2016-4554) * A NULL pointer dereference flaw was found in the way Squid processes ESI responses. If Squid was used as a reverse proxy or for TLS/HTTPS interception, a malicious server could use this flaw to crash the Squid worker process. (CVE-2016-4555) * An incorrect reference counting flaw was found in the way Squid processes ESI responses. If Squid is configured as reverse-proxy, for TLS/HTTPS interception, an attacker controlling a server accessed by Squid, could crash the squid worker, causing a Denial of Service attack. (CVE-2016-4556) Affected Software/OS: squid on CentOS 7 Solution: Please Install the Updated Packages. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-4051 BugTraq ID: 86788 http://www.securityfocus.com/bid/86788 BugTraq ID: 91787 http://www.securityfocus.com/bid/91787 Debian Security Information: DSA-3625 (Google Search) http://www.debian.org/security/2016/dsa-3625 https://security.gentoo.org/glsa/201607-01 http://www.openwall.com/lists/oss-security/2016/04/20/9 http://www.openwall.com/lists/oss-security/2016/04/20/6 RedHat Security Advisories: RHSA-2016:1138 https://access.redhat.com/errata/RHSA-2016:1138 RedHat Security Advisories: RHSA-2016:1139 https://access.redhat.com/errata/RHSA-2016:1139 RedHat Security Advisories: RHSA-2016:1140 https://access.redhat.com/errata/RHSA-2016:1140 http://www.securitytracker.com/id/1035646 SuSE Security Announcement: SUSE-SU-2016:1996 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html SuSE Security Announcement: SUSE-SU-2016:2089 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html SuSE Security Announcement: openSUSE-SU-2016:2081 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html http://www.ubuntu.com/usn/USN-2995-1 Common Vulnerability Exposure (CVE) ID: CVE-2016-4052 http://www.securitytracker.com/id/1035647 Common Vulnerability Exposure (CVE) ID: CVE-2016-4053 Common Vulnerability Exposure (CVE) ID: CVE-2016-4054 Common Vulnerability Exposure (CVE) ID: CVE-2016-4553 http://www.securitytracker.com/id/1035768 Common Vulnerability Exposure (CVE) ID: CVE-2016-4554 http://www.securitytracker.com/id/1035769 Common Vulnerability Exposure (CVE) ID: CVE-2016-4555 http://www.openwall.com/lists/oss-security/2016/05/06/3 http://www.openwall.com/lists/oss-security/2016/05/06/5 http://www.securitytracker.com/id/1035770 Common Vulnerability Exposure (CVE) ID: CVE-2016-4556 Common Vulnerability Exposure (CVE) ID: CVE-2009-0801 BugTraq ID: 33858 http://www.securityfocus.com/bid/33858 CERT/CC vulnerability note: VU#435052 http://www.kb.cert.org/vuls/id/435052
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.