CVE-2014-9749 Auth bypass in n/a
Authenticated users can bypass access controls by replaying stale nonces when Digest authentication is enabled in Squid.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-9749?
CVE-2014-9749 is a medium-severity authentication bypass vulnerability in Opensuse Opensuse, published on 6 Nov 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."
Weakness: CWE-264
Which versions are affected by CVE-2014-9749?
It affects 2 products.
Products include Opensuse Opensuse, Squid-Cache Squid.
How do I fix CVE-2014-9749?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2014-9749 being exploited?
There is no known exploitation of CVE-2014-9749 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as GHSA-4g27-gq63-x5mg.