Bug 968394 (CVE-2016-2571) - VUL-0: CVE-2016-2571: squid, squid3: Multiple DoS issues in HTTP Response processing
Summary: VUL-0: CVE-2016-2571: squid, squid3: Multiple DoS issues in HTTP Response pro...
Status: RESOLVED FIXED
Alias: CVE-2016-2571
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/162265/
Whiteboard: CVSSv2:RedHat:CVE-2016-2571:4.0:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2016-02-26 09:48 UTC by Alexander Bergmann
Modified: 2019-07-16 16:36 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2016-02-26 09:48:09 UTC 
http://www.squid-cache.org/Advisories/SQUID-2016_2.txt

Error handling for malformed HTTP responses can lead to a second
assertion with the same effects as the first issue. It is not easily
triggered in Squid-3 or normally in Squid-4.

However fixing the String issue makes it become easily triggerable in
Squid-4, and we do have a history of the assertion itself being
reported as occuring already but been unable to identify the vectors
code path to replicate it yet. So believe it can be achieved
independent of the String issues, even if we are unable so far to
identify how.

Patch URLs for this are:
http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13990.patch
http://www.squid-cache.org/Versions/v4/changesets/squid-4-14548.patch

----------------
For 'When we failed to parse a response, do not store the fake
half-baked response (via a replaceHttpReply() call)' in
squid-3.5-13990.patch and 'Do not store the fake half-baked response
(via replaceHttpReply)' in squid-4-14548.patch, use CVE-2016-2571.


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2571
http://seclists.org/oss-sec/2016/q1/442
Comment 1 Swamp Workflow Management 2016-02-26 23:00:57 UTC 
bugbot adjusting priority
Comment 7 Swamp Workflow Management 2016-08-09 15:13:42 UTC 
SUSE-SU-2016:1996-1: An update that fixes 25 vulnerabilities is now available.

Category: security (important)
Bug References: 895773,902197,938715,963539,967011,968392,968393,968394,968395,973782,973783,976553,976556,976708,979008,979009,979010,979011
CVE References: CVE-2011-3205,CVE-2011-4096,CVE-2012-5643,CVE-2013-0188,CVE-2013-4115,CVE-2014-0128,CVE-2014-6270,CVE-2014-7141,CVE-2014-7142,CVE-2015-5400,CVE-2016-2390,CVE-2016-2569,CVE-2016-2570,CVE-2016-2571,CVE-2016-2572,CVE-2016-3947,CVE-2016-3948,CVE-2016-4051,CVE-2016-4052,CVE-2016-4053,CVE-2016-4054,CVE-2016-4553,CVE-2016-4554,CVE-2016-4555,CVE-2016-4556
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    squid3-3.1.23-8.16.27.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    squid3-3.1.23-8.16.27.1
Comment 8 Swamp Workflow Management 2016-08-09 15:29:38 UTC 
SUSE-SU-2016:2008-1: An update that solves 16 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 902197,929493,938715,955783,959290,963539,968392,968393,968394,968395,973782,973783,976553,976556,979008,979009,979010,979011
CVE References: CVE-2015-3455,CVE-2015-5400,CVE-2016-2569,CVE-2016-2570,CVE-2016-2571,CVE-2016-2572,CVE-2016-3947,CVE-2016-3948,CVE-2016-4051,CVE-2016-4052,CVE-2016-4053,CVE-2016-4054,CVE-2016-4553,CVE-2016-4554,CVE-2016-4555,CVE-2016-4556
Sources used:
SUSE Linux Enterprise Server 12-SP1 (src):    squid-3.3.14-20.2
Comment 9 Swamp Workflow Management 2016-08-16 13:10:25 UTC 
openSUSE-SU-2016:2081-1: An update that solves 16 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 902197,929493,938715,955783,959290,963539,968392,968393,968394,968395,973782,973783,976553,976556,979008,979009,979010,979011
CVE References: CVE-2015-3455,CVE-2015-5400,CVE-2016-2569,CVE-2016-2570,CVE-2016-2571,CVE-2016-2572,CVE-2016-3947,CVE-2016-3948,CVE-2016-4051,CVE-2016-4052,CVE-2016-4053,CVE-2016-4054,CVE-2016-4553,CVE-2016-4554,CVE-2016-4555,CVE-2016-4556
Sources used:
openSUSE Leap 42.1 (src):    squid-3.3.14-6.1
Comment 10 Swamp Workflow Management 2016-08-16 16:10:06 UTC 
SUSE-SU-2016:2089-1: An update that fixes 25 vulnerabilities is now available.

Category: security (important)
Bug References: 895773,902197,938715,963539,967011,968392,968393,968394,968395,973782,973783,976553,976556,976708,979008,979009,979010,979011,993299
CVE References: CVE-2011-3205,CVE-2011-4096,CVE-2012-5643,CVE-2013-0188,CVE-2013-4115,CVE-2014-0128,CVE-2014-6270,CVE-2014-7141,CVE-2014-7142,CVE-2015-5400,CVE-2016-2390,CVE-2016-2569,CVE-2016-2570,CVE-2016-2571,CVE-2016-2572,CVE-2016-3947,CVE-2016-3948,CVE-2016-4051,CVE-2016-4052,CVE-2016-4053,CVE-2016-4054,CVE-2016-4553,CVE-2016-4554,CVE-2016-4555,CVE-2016-4556
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    squid3-3.1.23-8.16.30.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    squid3-3.1.23-8.16.30.1
Comment 11 Marcus Meissner 2016-12-19 10:37:17 UTC 
released
Comment 12 Swamp Workflow Management 2019-05-08 11:31:17 UTC 
This is an autogenerated message for OBS integration:
This bug (968394) was mentioned in
https://build.opensuse.org/request/show/701549 Factory / squid