Squid SSL-Bump HTTPS request processing DoS Vulnerability

Source: Internet
Author: User
Tags squid proxy

Release date:
Updated on:

Affected Systems:
Squid 3.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 66112
CVE (CAN) ID: CVE-2014-0128

Squid is an efficient Web Cache and proxy program.

An error exists in the status management implementation of SSL-Bump in versions earlier than Squid 3.3.12 and 3.4.4, which can be maliciously exploited to cause assertion failure through specially crafted HTTPS requests. To successfully exploit this vulnerability, you must enable the SSL-Bump function.

<* Source: Fabian Hugelshofer
Mathias Fischer

Link: http://secunia.com/advisories/57288/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Squid
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.squid-cache.org/Advisories/
Http://www.squid-cache.org/Advisories/SQUID-2014_1.txt

Squid details: click here
Squid: click here

Recommended reading:

Configure Squid proxy http and rsync

Squid: high-speed Web Access

CentOS 6.2 compilation and installation Squid configuration Reverse Proxy Server

Application of Squid in Enterprise Network

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.