CVE-2022-41318

Published: Dic 25, 2022 Last Modified: Apr 14, 2025 EU-VD ID: EUVD-2022-44526 Aliases: GSD-2022-41318
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: none
Availability: none

Description

AI Translation Available

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0016
Percentile
0,4th
Updated

EPSS Score Trend (Last 90 Days)

190

Integer Overflow or Wraparound

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality Access Control Other
Potential Impacts:
Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Memory) Dos: Instability Modify Memory Execute Unauthorized Code Or Commands Bypass Protection Mechanism Alter Execution Logic Dos: Resource Consumption (Cpu)
Applicable Platforms
Languages: C, Not Language-Specific
Likelihood of Exploit: Medium
View CWE Details
Application

Squid by Squid-Cache

Product Information
Vendor Squid-Cache
Product Squid
Version Range Affected
From 2.5 (inclusive)
To 5.7 (exclusive)
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/squid-cache/squid/security/advisories/GH…
Patch Third Party Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-394c-rr7q-6g78
https://www.openwall.com/lists/oss-security/2022/09/23/2
Mailing List Patch Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/09/23/2
http://www.squid-cache.org/Versions/v4/changesets/SQUID-202…
Patch Third Party Advisory
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_2.patch
http://www.squid-cache.org/Versions/v5/changesets/SQUID-202…
Patch Third Party Advisory
http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_2.patch
https://github.com/squid-cache/squid/security/advisories/GH…
Patch Third Party Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-394c-rr7q-6g78
https://www.openwall.com/lists/oss-security/2022/09/23/2
Mailing List Patch Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/09/23/2
http://www.squid-cache.org/Versions/v4/changesets/SQUID-202…
Patch Third Party Advisory
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_2.patch
http://www.squid-cache.org/Versions/v5/changesets/SQUID-202…
Patch Third Party Advisory
http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_2.patch