CVE-2016-10002

What it actually does

Incorrect processing of responses to If-None-Modified HTTP conditional requests causes client-specific Cookie data to be leaked from the proxy cache to other clients.

Why it matters to the business

Attackers can obtain session cookies and other authentication tokens belonging to different users, increasing the risk of account takeover and unauthorized access to sensitive services.

How an attack unfolds

An attacker sends specially crafted conditional requests to the proxy cache to trigger the leak and receive Cookie headers belonging to other clients that previously accessed the same resources.

How to fix it

Upgrade Squid to a version beyond 3.5.22 or 4.0.16; for the listed Ubuntu packages apply the referenced php5 5.5.9+dfsg-1ubuntu4.19 or php7.0 7.0.8-0ubuntu0.16.04.1 fixes and restart affected services.

How to confirm the fix worked

Confirm the installed Squid or php package version matches or exceeds the fixed releases, then test cache behavior with conditional requests to verify Cookie data is no longer leaked across clients.

Typical attack path

1. Identify a Squid proxy instance serving cached content
2. Craft HTTP requests using If-None-Modified headers targeting popular resources
3. Observe responses that incorrectly include Cookie data from other clients
4. Use harvested cookies to impersonate victims in subsequent requests

How to detect it

Inspect proxy access logs for repeated If-None-Modified requests returning Set-Cookie or Cookie headers that do not match the requesting client; look for cache hit responses containing authentication tokens.

What your security team should do

• Apply the listed fixed package versions immediately due to the high CVSS score and public exploitability
• Review proxy cache configurations to disable unnecessary caching of authenticated responses
• Monitor for unusual conditional request patterns that could indicate probing