NVD

Id
26562  
Name
CVE-2015-5400  
Description
Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-09-28  
Modified Date
2016-11-28  
Seq
2015-5400  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
140635 26562 CVE-2015-5400 FEDORA-2016-7b40eb9e29  View
140636 26562 CVE-2015-5400 SUSE-SU-2016:1996  View
140637 26562 CVE-2015-5400 SUSE-SU-2016:2089  View
140638 26562 CVE-2015-5400 openSUSE-SU-2016:2081  View
140639 26562 CVE-2015-5400 DSA-3327  View
140640 26562 CVE-2015-5400 [oss-security] 20150706 Squid HTTP proxy CVE request  View
140641 26562 CVE-2015-5400 [oss-security] 20150709 Re: Squid HTTP proxy CVE request  View
140642 26562 CVE-2015-5400 [oss-security] 20150710 Re: Squid HTTP proxy CVE request  View
140643 26562 CVE-2015-5400 [oss-security] 20150717 Re: Re: Squid HTTP proxy CVE request  View
140644 26562 CVE-2015-5400 75553  View
140645 26562 CVE-2015-5400 http://www.squid-cache.org/Advisories/SQUID-2015_2.txt  View
140646 26562 CVE-2015-5400 http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10494.patch  View
140647 26562 CVE-2015-5400 http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13225.patch  View
140648 26562 CVE-2015-5400 http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13856.patch  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
9677 JVNDB-2015-004997 Squid における制限を回避される脆弱性 Squid は、cache_peer が設定されている場合、CONNECT メソッドピアのレスポンスを適切に処理しないため、制限を回避され、バックエンドプロキシへのアクセス権を取得される脆弱性が存在します。 CVE-2015-5400 82625 CVE-2015-5400 26562 6.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-004997.html 2015-07-06 2015-10-01 View