Questions on Squid Version Detection / VTs (Squid Detection (HTTP))

[cfi]

Hello,

and welcome to this community forums. Only a few short notes:

1. Most of the flaws addressed in “Squid Multiple 0-Day Vulnerabilities” (Correct OID for this is: 1.3.6.1.4.1.25623.1.0.100439) are not fixed in any Squid release so far based on all available current info (only a few have unclear status with possible fixes but no official advisories), see e.g.:
   • https://megamansec.github.io/Squid-Security-Audit/
   • GitHub - MegaManSec/Squid-Security-Audit: A detailed repository of vulnerabilities that I discovered in The Squid Caching Proxy. · GitHub
   • NVT Update - #6 by cfi
   • Unofficial status of "Joshua 55" vulnerabilities in Squid · GitHub
2. The metadata of the Squid VT gives additional notes / hints to create possible overrides, please review the information already provided within carefully
3. FreeBSD LSCs are (at least currently) unsupported, see NVT: FreeBSD Ports: net-snmp. FALSE POSITIVE - #2 by cfi for more background info