ISOMAN

CVE

CVE-2019-18679

An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.

Severity
HIGH
CVSS
7.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource

References

  1. http://www.squid-cache.org/Advisories/SQUID-2019_11.txt
  2. http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patch
  3. https://bugzilla.suse.com/show_bug.cgi?id=1156324
  4. https://github.com/squid-cache/squid/pull/491
  5. https://lists.debian.org/debian-lts-announce/2019/12/msg00011.html
  6. https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
  7. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
  8. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
  9. https://security.gentoo.org/glsa/202003-34
  10. https://usn.ubuntu.com/4213-1/
  11. https://www.debian.org/security/2020/dsa-4682
  12. http://www.squid-cache.org/Advisories/SQUID-2019_11.txt
  13. http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patch
  14. https://bugzilla.suse.com/show_bug.cgi?id=1156324
  15. https://github.com/squid-cache/squid/pull/491
  16. https://lists.debian.org/debian-lts-announce/2019/12/msg00011.html
  17. https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
  18. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
  19. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
  20. https://security.gentoo.org/glsa/202003-34