CVE-2014-9749
NoneCVSS
—
EPSS
11.4%
Published
Nov 6, 2015
CISA due date
—
The record
Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Server 11 SP3 | squid | 0 | 2.7.STABLE5-2.12.24.2 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | squid | 0 | 2.7.STABLE5-2.12.24.2 |
| SUSE:Linux Enterprise Server 11 SP4 | squid | 0 | 2.7.STABLE5-2.12.24.2 |
| SUSE:Linux Enterprise Server 11 SP4 | squid3 | 0 | 3.1.23-8.16.36.1 |
| SUSE:Linux Enterprise Server 12 SP1 | squid | 0 | 3.3.14-22.6.1 |
| SUSE:Linux Enterprise Server 12 SP2 | squid | 0 | 3.5.21-25.1 |
| SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | squid | 0 | 3.5.21-25.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP3 | squid | 0 | 2.7.STABLE5-2.12.24.2 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | squid | 0 | 2.7.STABLE5-2.12.24.2 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | squid3 | 0 | 3.1.23-8.16.36.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | squid | 0 | 3.3.14-22.6.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | squid | 0 | 3.5.21-25.1 |
Related vulnerabilities
- CVE-2014-6270 Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when… Also affects squid
- CVE-2016-4554 mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended… Also affects squid
- CVE-2016-4051 Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9… Also affects squid
- CVE-2016-10002 Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid… Also affects squid3
- CVE-2016-4556 Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10… Also affects squid3
- CVE-2016-4555 client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote… Also affects squid3
- CVE-2016-4553 client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the… Also affects squid3
- CVE-2016-4054 Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers… Also affects squid3