CVE-2014-3609

What it actually does

Improper parsing of HTTP Range headers containing unidentifiable byte-range values triggers a crash in the HttpHdrRange.cc component.

Why it matters to the business

Proxy service becomes unavailable, interrupting web traffic filtering, caching, and access control for dependent users and applications until the process is restarted.

How an attack unfolds

An unauthenticated remote attacker crafts an HTTP request containing specially malformed Range headers and sends it to a vulnerable Squid instance, causing the proxy to crash on header processing.

How to fix it

Upgrade Squid to version 3.3.12, 3.4.6, or later; apply vendor patches if available for the deployed branch; restart the service after update.

How to confirm the fix worked

Verify the installed Squid version against the fixed releases; attempt reproduction of the crash with a test request containing crafted Range headers in a non-production environment; review release notes for the applied version.

Typical attack path

1. Identify a reachable Squid proxy
2. Craft an HTTP GET request with invalid byte-range values in the Range header
3. Transmit the request to trigger the parsing flaw and induce a crash

How to detect it

Review Squid access and cache logs for entries containing Range headers with non-standard byte-range syntax; correlate with process crash or segmentation fault entries in system logs around the same timestamps.

• HttpHdrRange.cc
• crafted Range headers
• unidentifiable byte-range values

What your security team should do

• Prioritize upgrade of all Squid instances to a fixed release
• Implement network-level filtering or WAF rules to drop suspicious Range headers if immediate patching is delayed
• Monitor proxy process health and restart automation to reduce downtime