Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Squid Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability - CVE-2019-12525 - Vulnerability Database
Squid

Squid Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability - CVE-2019-12525

Critical
Reference: CVE-2019-12525
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-12525
Title: Squid Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Overview:

An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication it parses the header Proxy-Authorization. It searches for certain tokens such as domain uri and qop. Squid checks if this token39s value starts with a quote and ends with one. If so it performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote (which would satisfy its requirements) leading to a memcpy of its length minus 1.