CVE-2009-0478
Summary
| CVE | CVE-2009-0478 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-02-08 22:30:00 UTC |
| Updated | 2018-10-11 21:01:00 UTC |
| Description | Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c. |
Risk And Classification
Problem Types: CWE-20
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Squid | Squid | 2.7.stable1 | All | All | All |
| Application | Squid | Squid | 2.7.stable2 | All | All | All |
| Application | Squid | Squid | 2.7.stable3 | All | All | All |
| Application | Squid | Squid | 2.7.stable4 | All | All | All |
| Application | Squid | Squid | 2.7.stable5 | All | All | All |
| Application | Squid | Squid | 3.0.stable1 | All | All | All |
| Application | Squid | Squid | 3.0.stable10 | All | All | All |
| Application | Squid | Squid | 3.0.stable11 | All | All | All |
| Application | Squid | Squid | 3.0.stable12 | All | All | All |
| Application | Squid | Squid | 3.0.stable2 | All | All | All |
| Application | Squid | Squid | 3.0.stable3 | All | All | All |
| Application | Squid | Squid | 3.0.stable4 | All | All | All |
| Application | Squid | Squid | 3.0.stable5 | All | All | All |
| Application | Squid | Squid | 3.0.stable6 | All | All | All |
| Application | Squid | Squid | 3.0.stable7 | All | All | All |
| Application | Squid | Squid | 3.0.stable8 | All | All | All |
| Application | Squid | Squid | 3.0.stable9 | All | All | All |
| Application | Squid | Squid | 3.1 | All | All | All |
| Application | Squid | Squid | 3.1.0.1 | All | All | All |
| Application | Squid | Squid | 3.1.0.2 | All | All | All |
| Application | Squid | Squid | 3.1.0.3 | All | All | All |
| Application | Squid | Squid | 3.1.0.4 | All | All | All |
| Application | Squid | Squid | 2.7.stable1 | All | All | All |
| Application | Squid | Squid | 2.7.stable2 | All | All | All |
| Application | Squid | Squid | 2.7.stable3 | All | All | All |
| Application | Squid | Squid | 2.7.stable4 | All | All | All |
| Application | Squid | Squid | 2.7.stable5 | All | All | All |
| Application | Squid | Squid | 3.0.stable1 | All | All | All |
| Application | Squid | Squid | 3.0.stable10 | All | All | All |
| Application | Squid | Squid | 3.0.stable11 | All | All | All |
| Application | Squid | Squid | 3.0.stable12 | All | All | All |
| Application | Squid | Squid | 3.0.stable2 | All | All | All |
| Application | Squid | Squid | 3.0.stable3 | All | All | All |
| Application | Squid | Squid | 3.0.stable4 | All | All | All |
| Application | Squid | Squid | 3.0.stable5 | All | All | All |
| Application | Squid | Squid | 3.0.stable6 | All | All | All |
| Application | Squid | Squid | 3.0.stable7 | All | All | All |
| Application | Squid | Squid | 3.0.stable8 | All | All | All |
| Application | Squid | Squid | 3.0.stable9 | All | All | All |
| Application | Squid | Squid | 3.1 | All | All | All |
| Application | Squid | Squid | 3.1.0.1 | All | All | All |
| Application | Squid | Squid | 3.1.0.2 | All | All | All |
| Application | Squid | Squid | 3.1.0.3 | All | All | All |
| Application | Squid | Squid | 3.1.0.4 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bug 484246 – CVE-2009-0478 Squid denial of service flaw | CONFIRM | bugzilla.redhat.com | |
| Support / Security / Advisories / / MDVSA-2009:034 | Mandriva | MANDRIVA | www.mandriva.com | |
| Gentoo update for Squid - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| www.squid-cache.org/Versions/v2/2.7/changesets/12432.patch | CONFIRM | www.squid-cache.org | Vendor Advisory |
| Gentoo Linux Documentation -- Squid: Multiple Denial of Service vulnerabilities | GENTOO | security.gentoo.org | |
| Squid HTTP Request Processing Error Lets Remote Users Deny Service - SecurityTracker | SECTRACK | www.securitytracker.com | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2009:005 | SUSE | lists.opensuse.org | |
| Squid Web Proxy Cache HTTP Version Number Parsing Denial of Service Vulnerability | BID | www.securityfocus.com | Exploit, Patch |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| Squid HTTP Version Number Parsing Denial of Service - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| Squid < 3.1 5 HTTP Version Number Parsing Denial of Service Exploit | EXPLOIT-DB | www.exploit-db.com | |
| www.squid-cache.org/Advisories/SQUID-2009_1.txt | CONFIRM | www.squid-cache.org | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2009-02-09 | Joshua Bressers | Not vulnerable. This issue did not affect the version of Squid as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5. |
There are currently no legacy QID mappings associated with this CVE.