Adzapper Squid_Redirect URI Handling Remote Denial of Service Vulnerability

Bugtraq ID:	16558
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-0046
Remote:	Yes
Local:	No
Published:	Feb 09 2006 12:00AM
Updated:	Feb 09 2006 05:03PM
Credit:	Discovered by Thomas Reifferscheid <[email protected]>.
Vulnerable:	Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 adzapper adzapper 20060115 adzapper adzapper 20050316 adzapper adzapper 20030726
Not Vulnerable:	adzapper adzapper 20060129

Adzapper Squid_Redirect URI Handling Remote Denial of Service Vulnerability


Adzapper is prone to a remote denial-of-service vulnerability when installed as a plugin in squid.

The vulnerability presents itself when a specially crafted URI is handled.

Adzapper versions prior to 2006-01-29 are vulnerable.

Adzapper Squid_Redirect URI Handling Remote Denial of Service Vulnerability


An exploit is not required.

Adzapper Squid_Redirect URI Handling Remote Denial of Service Vulnerability

Solution:

The vendor has addressed this issue in adzapper 20060129 and subsequent versions. Please see the referenced vendor advisories for more information.

Adzapper Squid_Redirect URI Handling Remote Denial of Service Vulnerability

References:

• Ad Zapping With Squid (Adzapper)
  
• Debian Bug report logs - #350308 - DoS possible against adzapper making squid un (Thomas Reifferscheid )