squid: lack of UID assignment in child process spawning could lead to privileges escalation
Published Apr 15, 2020
4.5
MEDIUMCVSS 3.1
EPSS 0.34%
Description
An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.
Affected products
No data.
- ≤ 4.7
No data.
Red Hat Enterprise Linux 5
squid
Out of support scope
Red Hat Enterprise Linux 6
squid
Out of support scope
Red Hat Enterprise Linux 6
squid34
Out of support scope
Red Hat Enterprise Linux 7
squid
Fix deferred
Red Hat Enterprise Linux 8
squid:4/squid
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | squid | Out of support scope | n/a |
| Red Hat Enterprise Linux 6 | squid | Out of support scope | n/a |
| Red Hat Enterprise Linux 6 | squid34 | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | squid | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | squid:4/squid | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This issue is not a big problem on its own, as it requires another remote code execution vulnerability or that a local user has the privileges to modify the squid processes to be exploited. Thus, it is actually closer to a security enhancement than a vulnerability.
References (7)
- https://access.redhat.com/security/cve/CVE-2019-12522 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1827580 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4117 Advisory
- https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12522.txt x_refsource_MISCThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-12522
- https://security.netapp.com/advisory/ntap-20210205-0006/ x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-12522
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-12522 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1827580 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4117 | Advisory | |
| https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12522.txt | x_refsource_MISCThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-12522 | ||
| https://security.netapp.com/advisory/ntap-20210205-0006/ | x_refsource_CONFIRMThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2019-12522 |
Change history (0)
No recorded changes yet.