CVE-2015-5400

Published: Sep 28, 2015Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.

Affected (4)

Products: Fedoraproject: Fedora · Debian: Debian Linux · Squid Cache: Squid

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 22

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Squid Cache Squid	Up to 3.5.2

Related CWEs

CWE-264

References (30)

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html

Source: cve@mitre.org

http://www.debian.org/security/2015/dsa-3327

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/07/06/8

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/07/09/12

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/07/10/2

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/07/17/14

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/bid/75553

Source: cve@mitre.org

http://www.securitytracker.com/id/1032873

Source: cve@mitre.org

http://www.squid-cache.org/Advisories/SQUID-2015_2.txt

Source: cve@mitre.org

Vendor Advisory

http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10494.patch

Source: cve@mitre.org

ExploitVendor Advisory

http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13225.patch

Source: cve@mitre.org

ExploitVendor Advisory

http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13856.patch

Source: cve@mitre.org

ExploitVendor Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html