Vulnerability Description
An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Squid-Cache | Squid | < 4.10 |
| Opensuse | Leap | 15.1 |
| Canonical | Ubuntu Linux | 16.04 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.htmlMailing ListThird Party Advisory
- http://www.squid-cache.org/Advisories/SQUID-2020_3.txtVendor Advisory
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-6982f1187a26557e582172PatchVendor Advisory
- https://security.gentoo.org/glsa/202003-34Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210304-0002/Third Party Advisory
- https://usn.ubuntu.com/4289-1/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.htmlMailing ListThird Party Advisory
- http://www.squid-cache.org/Advisories/SQUID-2020_3.txtVendor Advisory
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-6982f1187a26557e582172PatchVendor Advisory
- https://security.gentoo.org/glsa/202003-34Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210304-0002/Third Party Advisory
FAQ
What is CVE-2020-8517?
CVE-2020-8517 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On s...
How severe is CVE-2020-8517?
CVE-2020-8517 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-8517?
Check the references section above for vendor advisories and patch information. Affected products include: Squid-Cache Squid, Opensuse Leap, Canonical Ubuntu Linux.