High-Severity Squid Vulnerabilities Fixed in Ubuntu

Rohan Timalsina

February 20, 2024 - TuxCare expert team

Squid is a powerful tool for caching proxy for the web, but like any software, it is not immune to vulnerabilities. Several security vulnerabilities have been discovered that could potentially lead to a denial of service. So, if you’re using Squid, it’s essential to understand the nature of these vulnerabilities and take appropriate actions to mitigate any potential risks.

A Closer Look at the Squid Vulnerabilities

CVE-2023-49285 (Cvss 3 Severity Score: 7.5 High)

Joshua Rogers identified this vulnerability, which involves incorrect handling of HTTP message processing, potentially leading to a denial of service.

CVE-2023-49286 (Cvss 3 Severity Score: 7.5 High)

Discovered by Joshua Rogers, this vulnerability exists due to the incorrect handling of Helper process management, posing a risk of denial of service.

CVE-2023-50269 (Cvss 3 Severity Score: 7.5 High)

Once again identified by Joshua Rogers, this vulnerability involves the incorrect handling of HTTP request parsing, potentially leading to a denial of service.

CVE-2023-46724 (Cvss 3 Severity Score: 7.5 High)

Discovered by Joshua Rogers, this vulnerability affects certain versions of Ubuntu (22.04 LTS, 23.04, and 23.10) and could allow remote attackers to cause Squid to crash, resulting in a denial of service.

CVE-2023-46728 (Cvss 3 Severity Score: 7.5 High)

Also identified by Joshua Rogers, this vulnerability impacts Ubuntu versions 20.04 LTS, 22.04 LTS, and 23.04. It exists due to the mishandling of the Gopher protocol, potentially leading to a denial of service. To mitigate this risk, Gopher support has been disabled in the update.

CVE-2023-46846 (Cvss 3 Severity Score: 5.3 Medium)

Discovered by Keran Mu and Jianjun Chen, this vulnerability could enable remote attackers to conduct HTTP request smuggling attacks by exploiting the way Squid handles the chunked decoder.

CVE-2023-46847 (Cvss 3 Severity Score: 7.5 High)

Another finding by Joshua Rogers, this vulnerability affects the handling of HTTP Digest Authentication, potentially leading to a denial of service.

CVE-2023-46848 (Cvss 3 Severity Score: 7.5 High)

Once again discovered by Joshua Rogers, this vulnerability involves the incorrect handling of certain FTP URLs, which could result in a denial of service.

Mitigation Measures

Given the severity of these flaws, it’s imperative for Squid users on affected Linux systems to apply the necessary security updates promptly. By keeping your Squid installation up to date, you can ensure that known vulnerabilities are patched, reducing the risk of exploitation by malicious actors.

Patches for these vulnerabilities are released by TuxCare for many end-of-life systems, including Ubuntu 16.04, Ubuntu 18.04, CentOS 6, CentOS 8, Oracle Linux 6, and others. TuxCare offers Extended Lifecycle Support service for end-of-life Linux systems, providing automated vulnerability patches for up to 4 years after the EOL date.

Sources: USN-6500-1 and USN-6594-1

Summary