CVE-2010-0639
Summary
| CVE | CVE-2010-0639 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2010-02-15 18:30:00 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The htcpHandleTstRequest function in htcp.c in Squid 2.x before 2.6.STABLE24 and 2.7 before 2.7.STABLE8, and htcp.cc in 3.0 before 3.0.STABLE24, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets to the HTCP port. |
Risk And Classification
Primary CVSS: v2.0 5 from [email protected]
AV:N/AC:L/Au:N/C:N/I:N/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
NoneAvailability
PartialAV:N/AC:L/Au:N/C:N/I:N/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Squid-cache | Squid | 2.0 | All | All | All |
| Application | Squid-cache | Squid | 2.1 | All | All | All |
| Application | Squid-cache | Squid | 2.2 | All | All | All |
| Application | Squid-cache | Squid | 2.3 | All | All | All |
| Application | Squid-cache | Squid | 2.4 | All | All | All |
| Application | Squid-cache | Squid | 2.5 | All | All | All |
| Application | Squid-cache | Squid | 2.6 | All | All | All |
| Application | Squid-cache | Squid | 2.7 | All | All | All |
| Application | Squid-cache | Squid | 2.7 | stable3 | All | All |
| Application | Squid-cache | Squid | 2.7 | stable4 | All | All |
| Application | Squid-cache | Squid | 3.0 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable1 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable11 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable12 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable13 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable14 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable15 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable16 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable17 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable18 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable19 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable2 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable20 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable21 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable22 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable23 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable3 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable4 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable5 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable6 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable7 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable8 | All | All | All |
| Application | Squid-cache | Squid | 3.0.stable9 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Fedora update for squid - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| www.squid-cache.org/Versions/v2/2.7/changesets/12600.patch | af854a3a-2127-422b-91ae-364da2661108 | www.squid-cache.org | Patch |
| osvdb.org/62297 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| Squid Web Proxy Cache HTCP Request Processing Remote Denial of Service Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| [SECURITY] Fedora 11 Update: squid-3.0.STABLE24-1.fc11 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Bug 2858 – Segment violation in HTCP | af854a3a-2127-422b-91ae-364da2661108 | bugs.squid-cache.org | |
| www.squid-cache.org/Versions/v3/3.0/changesets/3.0-ADV-2010_2.patch | af854a3a-2127-422b-91ae-364da2661108 | www.squid-cache.org | Patch |
| www.squid-cache.org/Advisories/SQUID-2010_2.txt | af854a3a-2127-422b-91ae-364da2661108 | www.squid-cache.org | Vendor Advisory |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| SecurityTracker.com Archives - Squid HTCP Packet Processing NULL Pointer Dereference Lets Remote Users Deny Service | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| [SECURITY] Fedora 12 Update: squid-3.1.0.16-6.fc12 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2010-02-16 | Tomas Hoger | Not vulnerable. This issue did not affect the versions of squid as shipped with Red Hat Enterprise Linux 3, 4, or 5. Those versions are not compiled with the support for HTCP protocol. |
There are currently no legacy QID mappings associated with this CVE.