#VU20460 Out-of-bounds read in Squid - CVE-2019-12529 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU20460

#VU20460 Out-of-bounds read in Squid - CVE-2019-12529

Published: August 29, 2019


Vulnerability identifier: #VU20460
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-12529
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Squid
Software vendor:
Squid-cache.org

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when parsing username in the Proxy-Authorization header during HTTP Basic authentication. A remote attacker can send specially crafted request to the Squid proxy server and retrieve parts of memory contents, if the Squid maintainer had configured the display of usernames on error pages.


Remediation

Install updates from vendor's website.

External links