Published: 10/05/2016 Updated: 27/12/2019

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 8.6 | Impact Score: 4 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

client_side.cc in Squid prior to 3.5.18 and 4.x prior to 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote malicious users to conduct cache-poisoning attacks via an HTTP request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04
canonical ubuntu linux 16.04
canonical ubuntu linux 15.10
squid-cache squid
squid-cache squid 4.0.6
squid-cache squid 4.0.5
squid-cache squid 4.0.4
squid-cache squid 4.0.3
squid-cache squid 4.0.9
squid-cache squid 4.0.2
squid-cache squid 4.0.1
squid-cache squid 4.0.8
squid-cache squid 4.0.7
oracle linux 7

Debian Bug report logs - #823968 squid3: CVE-2016-4553 CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 Package: src:squid3; Maintainer for src:squid3 is Luigi Gangitano <luigi@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 10 May 2016 20:12:01 UTC Severity: important Tags: fixed-upstream, sec ...

Several security issues were fixed in Squid ...

Several security issues have been discovered in the Squid caching proxy CVE-2016-4051: CESG and Yuriy M Kaminskiy discovered that Squid cachemgrcgi was vulnerable to a buffer overflow when processing remotely supplied inputs relayed through Squid CVE-2016-4052: CESG discovered that a buffer overflow made Squid vulnerable to a ...

An input validation flaw was found in the way Squid handled intercepted HTTP Request messages An attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform cache poisoning attacks on Squid ...

CWE-345 http://www.securitytracker.com/id/1035768 http://bugs.squid-cache.org/show_bug.cgi?id=4501 http://www.squid-cache.org/Advisories/SQUID-2016_7.txt http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14039.patch http://www.ubuntu.com/usn/USN-2995-1 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html https://security.gentoo.org/glsa/201607-01 http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html http://www.debian.org/security/2016/dsa-3625 https://access.redhat.com/errata/RHSA-2016:1140 https://access.redhat.com/errata/RHSA-2016:1139 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823968 https://usn.ubuntu.com/2995-1/https://nvd.nist.gov

CVE-2016-4553

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect