🛑 CVE-2025-54574 — Heap Buffer Overflow in Squid (≤ 6.3) 🛑

Severity: Critical (CVSS 9.3) Affected Software: Squid Proxy (versions 6.3 and earlier) Vulnerability Type: Heap-based buffer overflow Discovered in: URN (Uniform Resource Name) processing Impact: Possible remote code execution or denial-of-service, exploitable over the network with no authentication required

🔍 What’s the issue?

The flaw occurs during how Squid parses URN responses. Improper memory handling leads to heap overflows, meaning a malicious HTTP response could corrupt memory, potentially letting an attacker crash Squid or run arbitrary code.

✅ How to Fix It

• Upgrade to Squid 6.4 or later. This version patches the vulnerability.
• As a temporary mitigation, you can disable URN access in your Squid configuration.

🧯 Risk Breakdown

🕒 Timeline

• Vulnerability announced: August 1, 2025
• Patch released in: Squid 6.4 (released late July 2025)

🛡 What Should You Do?

1. Check your current Squid version. If you’re on 6.3 or earlier, upgrade immediately.
2. If you cannot upgrade right away, disable URN handling in Squid’s ACL or configuration.
3. Keep your operating system's package manager up to date — patched versions may already be available.
4. Review proxy logs for unusual behavior or exploitation attempts targeting URNs.

To use your CVE-2025-54574.sh script safely and effectively on a Linux system (like Kali), follow these steps:

✅ How to Use the Script

1. Save the Script

If you haven’t already saved it, create the script file:

nano CVE-2025-54574.sh

Paste your script into the editor, then save with CTRL+O, Enter, and exit with CTRL+X.

2. Make It Executable

Give the script permission to run:

chmod +x CVE-2025-54574.sh

3. Run the Script as Root

Because it modifies /etc/squid/squid.conf and restarts services, you must run it with sudo or as root:

sudo ./CVE-2025-54574.sh

What it does:

• Checks if your installed Squid version ≤ 6.3

• If vulnerable:

  • Backs up your config file (/etc/squid/squid.conf.bak)
  • Adds rules to block URN access
  • Restarts Squid to apply changes

🧪 Optional: Test After Running

Check if Squid is running correctly:

sudo systemctl status squid

Look for syntax errors in the config (optional but good practice):

sudo squid -k parse

🔄 Optional: Revert Changes

If you want to undo the script's changes, restore the backup config:

sudo cp /etc/squid/squid.conf.bak /etc/squid/squid.conf
sudo systemctl restart squid

📝 Notes:

• Works only if your config is in /etc/squid/squid.conf (default path). If it’s somewhere else, update the script.
• Make sure bc is installed (used for version comparison). Install with:

sudo apt install bc

⚠️ Disclaimer !!!

• This script and accompanying information are provided “as is” without any warranties or guarantees. Use this material at your own risk. The author(s) assume no responsibility for any damage, data loss, or service interruptions that may result from running or modifying this script.

• It is strongly recommended to test all changes in a controlled environment before deploying to production. Always review configuration changes thoroughly and back up your data and settings prior to applying any fixes or mitigations.