Allele Security Alert
ASA-2018-00012, SQUID-2018:5, CVE-2018-19132
Denial of Service issue in SNMP processing
The Squid project
Squid 220.127.116.11 -> 3.1.23
Squid 18.104.22.168 -> 3.5.28
Squid 4.0 -> 4.3
Proof of concept
Due to a memory leak in SNMP query rejection code, Squid is vulnerable to a denial of service attack.
This problem allows a remote attacker to consume all memory available to the Squid process, causing it to crash.
In environments where per-process memory restrictions are not enforced strictly, or configured to large values this may also affect other processes operating on the same machine. Leading to a much worse denial of service situation.
This problem is limited to Squid built with SNMP support and receiving SNMP traffic.
Squid Proxy Cache Security Update Advisory SQUID-2018:5
Squid Proxy multiple vulnerabilities
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: February 1, 2019