CVE-2023-46847: Squid-cache Squid DoS Vulnerability

CVE-2023-46847 Overview

CVE-2023-46847 is a heap buffer overflow vulnerability in the Squid caching proxy server that enables remote attackers to cause a Denial of Service condition. The vulnerability exists in the HTTP Digest Authentication mechanism, allowing an attacker to write up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

Critical Impact

Remote unauthenticated attackers can crash Squid proxy servers by exploiting the HTTP Digest Authentication buffer overflow, potentially disrupting network access for all users relying on the proxy infrastructure.

Affected Products

• Squid-cache Squid (multiple versions)
• Red Hat Enterprise Linux 7.0, 8.0, 9.0
• Red Hat Enterprise Linux EUS 8.6, 8.8, 9.0, 9.2
• Red Hat Enterprise Linux for ARM 64 8.0
• Red Hat Enterprise Linux for IBM z Systems 8.0
• Red Hat Enterprise Linux for Power (little endian) 8.0
• Red Hat Enterprise Linux Server AUS 8.2, 8.4, 8.6, 9.2
• Red Hat Enterprise Linux Server TUS 8.2, 8.4, 8.6, 8.8, 9.2
• Red Hat Enterprise Linux Workstation 7.0

Discovery Timeline

• November 3, 2023 - CVE-2023-46847 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-46847

Vulnerability Analysis

This heap buffer overflow vulnerability (CWE-120) affects Squid proxy servers configured to use HTTP Digest Authentication. The flaw allows a remote attacker to perform a buffer overflow attack by sending specially crafted authentication requests that cause Squid to write up to 2 MB of arbitrary data beyond the bounds of allocated heap memory.

The attack can be executed from a network position without any authentication or user interaction, making it highly exploitable. The primary impact is on system availability, as the heap corruption typically results in the Squid process crashing or becoming unresponsive.

Organizations relying on Squid as their primary web caching and filtering proxy could experience significant service disruption if this vulnerability is exploited, affecting all users who depend on the proxy for internet access.

Root Cause

The vulnerability stems from improper input validation in Squid's HTTP Digest Authentication processing code. When handling authentication headers, the code fails to properly validate the size of input data before copying it into a fixed-size heap buffer. This classic buffer overflow condition (CWE-120: Buffer Copy without Checking Size of Input) allows attackers to overflow the buffer by up to 2 MB.

The root cause is a missing bounds check in the authentication parsing routine that should validate the length of incoming digest authentication parameters before allocating and writing to heap memory.

Attack Vector

The attack can be executed remotely over the network by any unauthenticated attacker who can reach the Squid proxy server. The attack vector involves sending HTTP requests with malformed Digest Authentication headers that contain oversized parameters designed to trigger the buffer overflow condition.

An attacker would craft HTTP requests with specially constructed Authorization: Digest headers containing parameters that exceed expected buffer sizes. When Squid parses these headers to process the authentication attempt, the oversized data overflows the heap buffer, corrupting adjacent memory and ultimately causing process termination.

The vulnerability is particularly concerning because Squid proxies are typically internet-facing services, exposing them to attacks from any network location.

Detection Methods for CVE-2023-46847

Indicators of Compromise

• Unexpected Squid process crashes or restarts, particularly when processing authentication requests
• Abnormal memory allocation patterns in Squid logs preceding crashes
• High volume of HTTP requests containing Digest Authentication headers from single sources
• Core dumps from Squid processes indicating heap corruption

Detection Strategies

• Monitor Squid access logs for unusual patterns in Authorization: Digest headers with abnormally long parameter values
• Implement network intrusion detection rules to identify oversized HTTP Digest Authentication headers
• Set up process monitoring to alert on unexpected Squid crashes or high restart frequency
• Deploy application-level firewall rules to validate HTTP header sizes before reaching Squid

Monitoring Recommendations

• Enable verbose logging for authentication attempts in Squid configuration to capture detailed header information
• Configure system monitoring to track Squid process memory usage and detect sudden spikes or crashes
• Implement centralized log analysis to correlate authentication failures across multiple proxy instances
• Set up automated alerting for Squid service availability with rapid detection of service outages

How to Mitigate CVE-2023-46847

Immediate Actions Required

• Update Squid to the latest patched version that addresses this vulnerability
• If immediate patching is not possible, consider temporarily disabling HTTP Digest Authentication
• Review Squid access control lists to limit which clients can send authentication requests
• Implement rate limiting on authentication attempts to reduce exploitation impact

Patch Information

Multiple security patches are available from various vendors to address this vulnerability:

• Squid-cache: Official patches available through the GitHub Squid Security Advisory
• Red Hat: Multiple security advisories released including RHSA-2023:6266, RHSA-2023:6267, RHSA-2023:6268, and subsequent updates
• Debian: Security updates available via Debian LTS Announcement
• NetApp: Advisory and patches available via NetApp Security Advisory NTAP-20231130-0002

Organizations should apply vendor-specific patches according to their deployment platform.

Workarounds

• Disable HTTP Digest Authentication in Squid configuration if not required for operations
• Configure network firewalls to restrict access to Squid only from trusted network segments
• Deploy a Web Application Firewall (WAF) to inspect and filter malformed authentication headers
• Implement network segmentation to limit blast radius if the proxy is compromised

# Configuration example - Disable Digest Authentication if not required
# In squid.conf, remove or comment out digest authentication helpers:
# auth_param digest program /usr/lib64/squid/digest_file_auth /etc/squid/passwd
# auth_param digest children 5

# Alternative: Restrict authentication to trusted networks only
acl trusted_networks src 10.0.0.0/8 192.168.0.0/16
http_access allow trusted_networks
http_access deny all

# Restart Squid to apply changes
systemctl restart squid