CVE-2014-7141

What it actually does

The pinger component performs an out-of-bounds read when processing a crafted type field inside an ICMP or ICMP6 packet, resulting in either disclosure of adjacent memory contents or a process crash.

Why it matters to the business

Service availability can be disrupted and sensitive memory contents may be exposed to unauthenticated remote parties, potentially affecting any deployment that relies on Squid for caching or proxying.

How an attack unfolds

An attacker sends a single, specially crafted ICMP or ICMP6 packet containing an invalid type value to a reachable Squid instance; the pinger process reads beyond the intended buffer bounds, either leaking memory or terminating.

How to fix it

Upgrade Squid 3.x to version 3.4.8 or later; if an upgrade is not immediately possible, restrict ICMP and ICMP6 traffic to the pinger process or disable the pinger feature where operationally acceptable.

How to confirm the fix worked

Confirm the installed Squid version is 3.4.8 or newer; test that the pinger process no longer crashes or leaks data when presented with the original malformed ICMP/ICMP6 packets.

Typical attack path

1. Locate an internet-facing or internally reachable Squid 3.x instance
2. Craft an ICMP or ICMP6 packet with an out-of-range type value
3. Transmit the packet to the target
4. Observe either a crash (DoS) or receive leaked memory contents in the reply

How to detect it

Review historical logs or packet captures for ICMP and ICMP6 traffic containing unusual type values directed at Squid hosts; look for sudden pinger process restarts or segmentation faults around the time of suspected activity.

What your security team should do

• Prioritize upgrade of all Squid 3.x deployments to 3.4.8 or newer within standard change windows
• Apply network ACLs to limit ICMP/ICMP6 traffic destined for the Squid host to trusted sources only
• Monitor for any remaining 3.x instances still in service and schedule their replacement