CVE-2020-8517

HIGH

Squid < 4.10 - Denial of Service via NTLM Credentials Buffer Overflow

Title source: llm
STIX 2.1

Description

An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy.

References (8)

Core 8
Core References
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4289-1/
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202003-34
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210304-0002/

Scores

CVSS v3 7.5
EPSS 0.0083
EPSS Percentile 74.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-20 CWE-787
Status published
Products (5)
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 19.10
opensuse/leap 15.1
squid-cache/squid < 4.10
Published Feb 04, 2020
Tracked Since Feb 18, 2026