Ubuntu 16.04 & 16.10 USN-3192-1 Critical: Squid Network Exposure

ubuntu

February 6, 2017

Squid could be made to expose sensitive information over the network.

Summary

Squid could be made to expose sensitive information over the network.

Software Description:

- squid3: Web proxy cache server

Details:

Saulius Lapinskas discovered that Squid incorrectly handled processing

HTTP conditional requests. A remote attacker could possibly use this issue

to obtain sensitive information related to other clients' browsing

sessions. (CVE-2016-10002)

Felix Hassert discovered that Squid incorrectly handled certain HTTP

Request headers when using the Collapsed Forwarding feature. A remote

attacker could possibly use this issue to obtain sensitive information

related to other clients' browsing sessions. This issue only applied to

Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-10003)

Topics Covered

security advisory information leak remote attack squid ubuntu network exposure

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  squid3                          3.5.12-1ubuntu8.1

Ubuntu 16.04 LTS:
  squid3                          3.5.12-1ubuntu7.3

Ubuntu 14.04 LTS:
  squid3                          3.3.8-1ubuntu6.9

Ubuntu 12.04 LTS:
  squid3                          3.1.19-1ubuntu3.12.04.8

In general, a standard system update will make all the necessary changes.