CVE-2020-11945
📋 TL;DR
CVE-2020-11945 is a critical integer overflow vulnerability in Squid proxy server's Digest Authentication mechanism. A remote attacker can replay sniffed authentication nonces to bypass access controls and potentially execute arbitrary code. This affects all Squid installations using Digest Authentication before version 5.0.2.
💻 Affected Systems
- Squid
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Squid by Squid Cache
Squid by Squid Cache
Squid by Squid Cache
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Authentication bypass allowing unauthorized access to protected resources and potential privilege escalation.
If Mitigated
Limited impact with proper network segmentation and authentication monitoring in place.
🎯 Exploit Status
Exploit requires ability to sniff network traffic containing Digest Authentication nonces. The vulnerability is well-documented with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.2 or later
Vendor Advisory: http://www.squid-cache.org/Advisories/SQUID-2020_2.txt
Restart Required: Yes
Instructions:
1. Backup current Squid configuration. 2. Upgrade Squid to version 5.0.2 or later using your package manager. 3. Restart Squid service. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable Digest Authentication
allTemporarily disable Digest Authentication until patching can be completed
Edit squid.conf and remove or comment out 'auth_param digest' lines
Run: squid -k reconfigure
Network Segmentation
allRestrict access to Squid proxy to trusted networks only
Configure firewall rules to limit Squid access
Use ACLs in squid.conf to restrict client IPs
🧯 If You Can't Patch
- Implement strict network monitoring for authentication bypass attempts
- Deploy Squid behind a WAF with authentication protection rules
🔍 How to Verify
Check if Vulnerable:
Check Squid version and Digest Authentication configuration: squid -v | grep Version && grep -i 'auth_param digest' /etc/squid/squid.confCheck Version:
squid -v | grep VersionVerify Fix Applied:
Verify Squid version is 5.0.2 or later: squid -v | grep 'Version 5\.0\.[2-9]\|Version [5-9]\.[1-9]'📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from same source
- Successful authentication with replayed nonces
- Unexpected access to restricted resources
Network Indicators:
- Unusual Digest Authentication traffic patterns
- Repeated authentication requests with same nonce
SIEM Query:
source="squid" AND ("authentication failure" OR "access denied") | stats count by src_ip🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
- http://master.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e85ae34b02c34e9a811.patch
- http://www.openwall.com/lists/oss-security/2020/04/23/2
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e85ae34b02c34e9a811.patch
- https://bugzilla.suse.com/show_bug.cgi?id=1170313
- https://github.com/squid-cache/squid/commit/eeebf0f37a72a2de08348e85ae34b02c34e9a811
- https://github.com/squid-cache/squid/pull/585
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FWQRYZJPHAZBLXJ56FPCHJN5X2FP3VA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4MWXEZAJSOGRJSS2JCJK4WBSND4IV46/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RV2VZWFJNO3B56IVN56HHKJASG5DYUIX/
- https://security.gentoo.org/glsa/202005-05
- https://security.netapp.com/advisory/ntap-20210304-0004/
- https://usn.ubuntu.com/4356-1/
- https://www.debian.org/security/2020/dsa-4682
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
- http://master.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e85ae34b02c34e9a811.patch
- http://www.openwall.com/lists/oss-security/2020/04/23/2
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e85ae34b02c34e9a811.patch
- https://bugzilla.suse.com/show_bug.cgi?id=1170313
- https://github.com/squid-cache/squid/commit/eeebf0f37a72a2de08348e85ae34b02c34e9a811
- https://github.com/squid-cache/squid/pull/585
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FWQRYZJPHAZBLXJ56FPCHJN5X2FP3VA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4MWXEZAJSOGRJSS2JCJK4WBSND4IV46/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RV2VZWFJNO3B56IVN56HHKJASG5DYUIX/
- https://security.gentoo.org/glsa/202005-05
- https://security.netapp.com/advisory/ntap-20210304-0004/
- https://usn.ubuntu.com/4356-1/
- https://www.debian.org/security/2020/dsa-4682
