CVE-2016-2390 The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows....
MediumCVSS 5.9
EPSS 25.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/squid(Debian:12) | < 4.1-1 | 4.1-1 |
| debian/squid(Debian:13) | < 4.1-1 | 4.1-1 |
| debian/squid(Debian:14) | < 4.1-1 | 4.1-1 |
| squid-cache squid | <= 3.5.13 | No fix listed |
| squid-cache squid | = 4.0.4 | No fix listed |
| squid-cache squid | = 4.0.5 | No fix listed |
References
- Debian Security Tracker CVE-2016-2390 vendor-advisory
- bugs.squid-cache.org
- SUSE-SU-2016:1996 vendor-advisory
- SUSE-SU-2016:2089 vendor-advisory
- [squid-announce] 20160216 Squid 3.5.14 is available mailing-list vendor-advisory
- [squid-announce] 20160216 Squid 4.0.6 beta is available mailing-list vendor-advisory
- 1035045 vdb-entry
- www.squid-cache.org vendor-advisory