cve-2018-1000027
Vulnerability from cvelistv5
Published
2018-02-09 23:00
Modified
2024-08-05 12:33
Severity
Summary
The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later.
References
SourceURLTags
cve@mitre.orghttp://www.squid-cache.org/Advisories/SQUID-2018_2.txtPatch, Vendor Advisory
cve@mitre.orghttp://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patchPatch, Vendor Advisory
cve@mitre.orghttp://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_2.patchPatch, Vendor Advisory
cve@mitre.orghttps://github.com/squid-cache/squid/pull/129/filesThird Party Advisory
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2018/02/msg00001.htmlMailing List, Third Party Advisory
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2018/02/msg00002.htmlMailing List, Third Party Advisory
cve@mitre.orghttps://usn.ubuntu.com/3557-1/Third Party Advisory
cve@mitre.orghttps://usn.ubuntu.com/4059-2/
cve@mitre.orghttps://www.debian.org/security/2018/dsa-4122Third Party Advisory
Impacted products
VendorProduct
n/an/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:33:49.031Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3557-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3557-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_2.patch"
          },
          {
            "name": "DSA-4122",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4122"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.squid-cache.org/Advisories/SQUID-2018_2.txt"
          },
          {
            "name": "[debian-lts-announce] 20180202 [SECURITY] [DLA 1266-1] squid3 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/squid-cache/squid/pull/129/files"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patch"
          },
          {
            "name": "[debian-lts-announce] 20180202 [SECURITY] [DLA 1267-1] squid security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00002.html"
          },
          {
            "name": "USN-4059-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4059-2/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-01-18T00:00:00",
      "datePublic": "2018-01-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-17T15:06:10",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3557-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3557-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_2.patch"
        },
        {
          "name": "DSA-4122",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4122"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.squid-cache.org/Advisories/SQUID-2018_2.txt"
        },
        {
          "name": "[debian-lts-announce] 20180202 [SECURITY] [DLA 1266-1] squid3 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/squid-cache/squid/pull/129/files"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patch"
        },
        {
          "name": "[debian-lts-announce] 20180202 [SECURITY] [DLA 1267-1] squid security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00002.html"
        },
        {
          "name": "USN-4059-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4059-2/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "1/18/2018 15:05:14",
          "ID": "CVE-2018-1000027",
          "REQUESTER": "squid3@treenet.co.nz",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3557-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3557-1/"
            },
            {
              "name": "http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_2.patch",
              "refsource": "CONFIRM",
              "url": "http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_2.patch"
            },
            {
              "name": "DSA-4122",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4122"
            },
            {
              "name": "http://www.squid-cache.org/Advisories/SQUID-2018_2.txt",
              "refsource": "CONFIRM",
              "url": "http://www.squid-cache.org/Advisories/SQUID-2018_2.txt"
            },
            {
              "name": "[debian-lts-announce] 20180202 [SECURITY] [DLA 1266-1] squid3 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00001.html"
            },
            {
              "name": "https://github.com/squid-cache/squid/pull/129/files",
              "refsource": "CONFIRM",
              "url": "https://github.com/squid-cache/squid/pull/129/files"
            },
            {
              "name": "http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patch",
              "refsource": "CONFIRM",
              "url": "http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patch"
            },
            {
              "name": "[debian-lts-announce] 20180202 [SECURITY] [DLA 1267-1] squid security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00002.html"
            },
            {
              "name": "USN-4059-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4059-2/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000027",
    "datePublished": "2018-02-09T23:00:00",
    "dateReserved": "2018-01-29T00:00:00",
    "dateUpdated": "2024-08-05T12:33:49.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-1000027\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2018-02-09T23:29:00.870\",\"lastModified\":\"2019-07-17T16:15:12.210\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later.\"},{\"lang\":\"es\",\"value\":\"Squid Software Foundation Squid HTTP Caching Proxy, en versiones anteriores a la 4.0.23, contiene una vulnerabilidad de desreferencia de puntero NULL en el procesamiento de cabeceras HTTP Response X-Forwarded-For. Esto puede resultar en una denegaci\u00f3n de servicio (DoS) para todos los clientes que empleen el proxy. Este ataque parece ser explotable mediante un servidor HTTP remoto que responda con una cabecera X-Forwarded-For a ciertos tipos de petici\u00f3n HTTP. Parece ser que la vulnerabilidad se ha solucionado en la versi\u00f3n 4.0.23 y siguientes.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":5.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":true,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.0.23\",\"matchCriteriaId\":\"07AA78F0-BFDD-4DF6-9B03-D70E23B73E1C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F59A04-14CF-49E2-9973-645477EA09DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9070C9D8-A14A-467F-8253-33B966C16886\"}]}]}],\"references\":[{\"url\":\"http://www.squid-cache.org/Advisories/SQUID-2018_2.txt\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patch\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_2.patch\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/squid-cache/squid/pull/129/files\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/02/msg00001.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/02/msg00002.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/3557-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4059-2/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.debian.org/security/2018/dsa-4122\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.