Ubuntu 19.10: 4213-1 Critical: Squid DoS and Access Issues

ubuntu

December 4, 2019

Several security issues were fixed in Squid.

Summary

Several security issues were fixed in Squid.

Software Description:

- squid: Web proxy cache server

- squid3: Web proxy cache server

Details:

Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly

handled certain URN requests. A remote attacker could possibly use this

issue to bypass access checks and access restricted servers. This issue was

only addressed in Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-12523)

Jeriko One discovered that Squid incorrectly handed URN responses. A remote

attacker could use this issue to cause Squid to crash, resulting in a

denial of service, or possibly execute arbitrary code. (CVE-2019-12526)

Alex Rousskov discovered that Squid incorrectly handled certain strings. A

remote attacker could possibly use this issue to cause Squid to crash,

resulting in a denial of service. This issue only affected Ubuntu 19.04.

(CVE-2019-12854)

Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly

handled certain...

Read the Full Advisory

Topics Covered

security advisory remote code execution DoS Ubuntu squid access issues HTTP request smuggling

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
  squid                           4.8-1ubuntu2.1

Ubuntu 19.04:
  squid                           4.4-1ubuntu2.3

Ubuntu 18.04 LTS:
  squid3                          3.5.27-1ubuntu1.4

Ubuntu 16.04 LTS:
  squid3                          3.5.12-1ubuntu7.9

In general, a standard system update will make all the necessary changes.