CVE-2016-10002

Опубликовано: 27 янв. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Средний

Описание

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

Ссылки

http://rhn.redhat.com/errata/RHSA-2017-0182.html
http://rhn.redhat.com/errata/RHSA-2017-0183.html
http://www.debian.org/security/2016/dsa-3745
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/18/1
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/94953
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037513
Third Party Advisory
VDB Entry
http://www.squid-cache.org/Advisories/SQUID-2016_11.txt
Mitigation
Patch
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0182.html
http://rhn.redhat.com/errata/RHSA-2017-0183.html
http://www.debian.org/security/2016/dsa-3745
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/18/1
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/94953
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037513
Third Party Advisory
VDB Entry
http://www.squid-cache.org/Advisories/SQUID-2016_11.txt
Mitigation
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.15:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.16:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.17:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.18:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.19:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.20:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.21:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.22:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.1.23:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.10:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.11:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.12:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.13:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.14:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.15:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.16:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.17:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.18:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.0.19:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.1:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.2:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.3:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.4:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.5:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.6:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.7:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.8:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.9:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.10:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.11:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.12:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.13:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.2.14:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:squid-cache:squid:3.3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.0.2:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.0.3:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.1:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.2:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.3:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.4:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.5:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.6:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.7:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.8:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.9:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.10:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.11:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.12:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.13:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.3.14:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:squid-cache:squid:3.4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.1:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.2:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.3:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.4:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.5:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.6:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.7:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.8:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.9:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.10:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.11:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.12:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.13:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.4.14:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:a:squid-cache:squid:3.5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.0.2:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.0.3:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.0.4:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.1:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.2:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.3:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.4:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.5:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.6:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.7:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.8:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.9:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.10:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.11:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.12:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.13:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.14:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.15:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.16:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.17:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.18:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.19:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.20:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.21:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:3.5.22:*:*:*:*:*:*:*

Конфигурация 7

Одно из

cpe:2.3:a:squid-cache:squid:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.8:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.9:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.10:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.11:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.12:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.13:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.14:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.15:*:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:4.0.16:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.30071

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2016-10002

CVSS3: 7.5

ubuntu

почти 9 лет назад

CVE-2016-10002

CVSS3: 5.3

redhat

почти 9 лет назад

CVE-2016-10002

CVSS3: 7.5

debian

почти 9 лет назад

Incorrect processing of responses to If-None-Modified HTTP conditional ...

GHSA-mgr8-2fmh-mcqw

CVSS3: 7.5

github

больше 3 лет назад

ELSA-2017-0183

oracle-oval

почти 9 лет назад

ELSA-2017-0183: squid34 security update (MODERATE)

EPSS

Процентиль: 96%

0.30071

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200