CVE-2019-18679
📋 TL;DR
This Squid vulnerability exposes heap memory pointer values in nonce tokens during HTTP Digest Authentication, weakening ASLR protections. Attackers can use this information disclosure to map memory layouts and potentially facilitate remote code execution attacks. All Squid 2.x, 3.x, and 4.x through 4.8 installations using HTTP Digest Authentication are affected.
💻 Affected Systems
- Squid
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Squid by Squid Cache
Squid by Squid Cache
Squid by Squid Cache
Squid by Squid Cache
Squid by Squid Cache
Squid by Squid Cache
Squid by Squid Cache
Squid by Squid Cache
Squid by Squid Cache
Squid by Squid Cache
Squid by Squid Cache
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Attackers combine this information disclosure with other vulnerabilities to achieve remote code execution, potentially compromising the entire Squid proxy server.
Likely Case
Attackers gather memory layout information to improve reliability of other exploitation attempts against the Squid instance.
If Mitigated
Information disclosure occurs but attackers cannot chain it with other vulnerabilities due to proper security controls.
🎯 Exploit Status
Exploitation requires HTTP Digest Authentication to be enabled and typically requires chaining with other vulnerabilities for full impact.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Squid 4.9 and later, or apply specific patches to earlier versions
Vendor Advisory: http://www.squid-cache.org/Advisories/SQUID-2019_11.txt
Restart Required: Yes
Instructions:
1. Upgrade to Squid 4.9 or later. 2. For earlier versions, apply the patch from squid-cache.org. 3. Restart Squid service.
🔧 Temporary Workarounds
Disable HTTP Digest Authentication
linuxDisable HTTP Digest Authentication if not required for your deployment
Edit squid.conf and remove or comment out 'auth_param digest' lines
Restart Squid: systemctl restart squid
🧯 If You Can't Patch
- Disable HTTP Digest Authentication entirely
- Implement network segmentation to restrict access to Squid proxy
🔍 How to Verify
Check if Vulnerable:
Check Squid version and configuration for HTTP Digest Authentication usageCheck Version:
squid -v | grep VersionVerify Fix Applied:
Verify Squid version is 4.9+ or check that patch has been applied📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts using Digest method
- Multiple failed authentication attempts
Network Indicators:
- HTTP requests with Digest authentication headers to Squid proxy
SIEM Query:
source="squid" AND "digest" AND ("auth" OR "authentication")🔗 References
- http://www.squid-cache.org/Advisories/SQUID-2019_11.txt
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patch
- https://bugzilla.suse.com/show_bug.cgi?id=1156324
- https://github.com/squid-cache/squid/pull/491
- https://lists.debian.org/debian-lts-announce/2019/12/msg00011.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
- https://security.gentoo.org/glsa/202003-34
- https://usn.ubuntu.com/4213-1/
- https://www.debian.org/security/2020/dsa-4682
- http://www.squid-cache.org/Advisories/SQUID-2019_11.txt
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patch
- https://bugzilla.suse.com/show_bug.cgi?id=1156324
- https://github.com/squid-cache/squid/pull/491
- https://lists.debian.org/debian-lts-announce/2019/12/msg00011.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
- https://security.gentoo.org/glsa/202003-34
- https://usn.ubuntu.com/4213-1/
- https://www.debian.org/security/2020/dsa-4682
