“Squidbleed”: a 29-year-old vulnerability in the Squid proxy server allows HTTP requests to be intercepted

Security researchers have discovered a vulnerability in the widely used Squid proxy server and given it the name “Squidbleed” — by analogy with the well-known Heartbleed vulnerability in OpenSSL. According to available information, the flaw allows an attacker to gain access to the contents of the HTTP requests processed by the proxy server.

What makes this case remarkable is that the vulnerability has been present in Squid's code for twenty-nine years. This makes it one of the longest-lived known security issues in open-source software of this kind.

Squid is a free, open-source caching proxy server used both in corporate networks — to speed up access to web resources and to filter traffic — and as part of more complex network infrastructures. A leak of HTTP requests through such a proxy could potentially expose confidential information that users transmit over the network, including request parameters and headers.

Details of the story came to light thanks to security researcher Bruce Schneier's traditional Friday column about squid, in which this time the material, unusually, overlapped with the blog's main cybersecurity theme — owing to a fortunate coincidence in the name of the vulnerable product.

Users and administrators running Squid in their infrastructure should keep an eye on security updates and the project developers' recommendations, so as to address the issue in a timely manner.

Source: Schneier on Security