CyberRota Analysis
AI-GeneratedSquid, a caching proxy for the web, is vulnerable to a heap-based buffer overflow due to improper input validation in cache digest reply handling, specifically affecting versions prior to 7.6. This vulnerability allows a trusted peer to send a maliciously crafted reply that can exceed the declared size, potentially leading to arbitrary code execution. Organizations using Squid with the --enable-cache-digests option and configured with cache_peer entries should prioritize upgrading to version 7.6 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests option and configured with cache_peer entries. This issue is fixed in version 7.6.
Related CVEs
Other vulnerabilities affecting the same vendor(s)