SB2014112603 - Input validation error in Squid-cache Squid
Published: November 26, 2014 Updated: July 28, 2020
Security Bulletin ID
SB2014112603
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2014-7142)
The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
Remediation
Install update from vendor's website.
References
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
- http://seclists.org/oss-sec/2014/q3/539
- http://seclists.org/oss-sec/2014/q3/613
- http://seclists.org/oss-sec/2014/q3/626
- http://secunia.com/advisories/60242
- http://ubuntu.com/usn/usn-2422-1
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- http://www.securityfocus.com/bid/70022
- http://www.squid-cache.org/Advisories/SQUID-2014_4.txt
- https://bugzilla.novell.com/show_bug.cgi?id=891268