ASA-2019-00453 – Squid: Denial of Service issue in HTTP Digest Authentication processing


Allele Security Alert

ASA-2019-00453

Identifier(s)

ASA-2019-00453, CVE-2019-12525, SQUID-2019:3

Title

Denial of Service issue in HTTP Digest Authentication processing

Vendor(s)

The Squid project

Product(s)

Squid

Affected version(s)

Squid 3.3.9 -> 3.5.28
Squid 4.x -> 4.7

Fixed version(s)

Squid 4.8

Proof of concept

Unknown

Description

Due to incorrect buffer management Squid is vulnerable to a denial of service attack when processing HTTP Digest Authentication credentials.

Technical details

Unknown

Credits

Jeriko One

Reference(s)

Squid Proxy Cache Security Update Advisory SQUID-2019:3
http://www.squid-cache.org/Advisories/SQUID-2019_3.txt

CVE-2019-12525
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12525

CVE-2019-12525
https://nvd.nist.gov/vuln/detail/CVE-2019-12525

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: July 18, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.