Squid Web Proxy Cache HTTP Version Number Parsing Denial of Service Vulnerability

Bugtraq ID:	33604
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2009-0478
Remote:	Yes
Local:	No
Published:	Feb 02 2009 12:00AM
Updated:	Apr 13 2015 08:14PM
Credit:	Joshua Morin, Mikko Varpiola, and Jukka Taimisto
Vulnerable:	Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Squid Web Proxy Cache 3.1 .4 Squid Web Proxy Cache 3.0 Squid Web Proxy Cache 3.1 Squid Web Proxy Cache 3.0.STABLE7 Squid Web Proxy Cache 3.0.STABLE6 Squid Web Proxy Cache 3.0.STABLE5 Squid Web Proxy Cache 3.0.STABLE4 Squid Web Proxy Cache 3.0.STABLE3 Squid Web Proxy Cache 3.0.STABLE2 Squid Web Proxy Cache 3.0.STABLE12 Squid Web Proxy Cache 3.0.STABLE1 Squid Web Proxy Cache 2.7.STABLE5 Squid Web Proxy Cache 2.7 S.u.S.E. openSUSE 11.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	Squid Web Proxy Cache 3.1 .5 Squid Web Proxy Cache 3.0.STABLE13 Squid Web Proxy Cache 2.7.STABLE6

Squid Web Proxy Cache HTTP Version Number Parsing Denial of Service Vulnerability

Squid is prone to a remote denial-of-service vulnerability because the proxy server fails to handle certain HTTP requests.

Successfully exploiting this issue allows remote attackers to crash the affected application, denying further service to legitimate users.

This issue affects versions prior to Squid 2.7.STABLE5, Squid 3.0.STABLE12, and Squid 3.1.0.4.

Squid Web Proxy Cache HTTP Version Number Parsing Denial of Service Vulnerability

An attacker may exploit this issue by using readily available networking tools.

The following exploit is available:

• /data/vulnerabilities/exploits/33604.pl

Squid Web Proxy Cache HTTP Version Number Parsing Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva squid-3.0-1.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-1.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 arm

• Debian squid3-cgi_3.0.PRE5-5+etch1_arm.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch1_arm.deb


• Debian squid3-client_3.0.PRE5-5+etch1_arm.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch1_arm.deb


• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb


• Debian squid3_3.0.PRE5-5+etch1_arm.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch1_arm.deb

Mandriva Linux Mandrake 2008.1

• Mandriva squid-3.0-1.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-1.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu squid-cgi_2.7.STABLE3-1ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/s/squid/squid-cgi_2.7.STABLE3-1u buntu2.1_powerpc.deb


• Ubuntu squid_2.7.STABLE3-1ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/s/squid/squid_2.7.STABLE3-1ubuntu2.1 _powerpc.deb

Debian Linux 4.0 powerpc

• Debian squid3-cgi_3.0.PRE5-5+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch1_powerpc.deb


• Debian squid3-client_3.0.PRE5-5+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch1_powerpc.deb


• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb


• Debian squid3_3.0.PRE5-5+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch1_powerpc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu squid-cgi_2.7.STABLE3-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.7. STABLE3-1ubuntu2.1_i386.deb


• Ubuntu squid_2.7.STABLE3-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.7.STABLE3- 1ubuntu2.1_i386.deb

Debian Linux 4.0 m68k

• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu squid-cgi_2.7.STABLE3-1ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/s/squid/squid-cgi_2.7.STABLE3-1u buntu2.1_lpia.deb


• Ubuntu squid_2.7.STABLE3-1ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/s/squid/squid_2.7.STABLE3-1ubuntu2.1 _lpia.deb

Debian Linux 4.0 amd64

• Debian squid3-cgi_3.0.PRE5-5+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch1_amd64.deb


• Debian squid3-client_3.0.PRE5-5+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch1_amd64.deb


• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb


• Debian squid3_3.0.PRE5-5+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch1_amd64.deb

Debian Linux 4.0 ia-32

• Debian squid3-cgi_3.0.PRE5-5+etch1_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch1_i386.deb


• Debian squid3-client_3.0.PRE5-5+etch1_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch1_i386.deb


• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb


• Debian squid3_3.0.PRE5-5+etch1_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch1_i386.deb

Debian Linux 4.0 hppa

• Debian squid3-cgi_3.0.PRE5-5+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch1_hppa.deb


• Debian squid3-client_3.0.PRE5-5+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch1_hppa.deb


• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb


• Debian squid3_3.0.PRE5-5+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch1_hppa.deb

Debian Linux 4.0 sparc

• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb

Debian Linux 4.0 s/390

• Debian squid3-cgi_3.0.PRE5-5+etch1_s390.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch1_s390.deb


• Debian squid3-client_3.0.PRE5-5+etch1_s390.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch1_s390.deb


• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb


• Debian squid3_3.0.PRE5-5+etch1_s390.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch1_s390.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu squid-cgi_2.7.STABLE3-1ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/s/squid/squid-cgi_2.7.STABLE3-1u buntu2.1_sparc.deb


• Ubuntu squid_2.7.STABLE3-1ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/s/squid/squid_2.7.STABLE3-1ubuntu2.1 _sparc.deb

Mandriva Linux Mandrake 2009.0

• Mandriva squid-3.0-8.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-8.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 alpha

• Debian squid3-cgi_3.0.PRE5-5+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch1_alpha.deb


• Debian squid3-client_3.0.PRE5-5+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch1_alpha.deb


• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb


• Debian squid3_3.0.PRE5-5+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch1_alpha.deb

Debian Linux 4.0 armel

• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb

Debian Linux 4.0

• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva squid-3.0-8.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-8.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 mipsel

• Debian squid3-cgi_3.0.PRE5-5+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch1_mipsel.deb


• Debian squid3-client_3.0.PRE5-5+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch1_mipsel.deb


• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb


• Debian squid3_3.0.PRE5-5+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch1_mipsel.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu squid-cgi_2.7.STABLE3-1ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.7. STABLE3-1ubuntu2.1_amd64.deb


• Ubuntu squid_2.7.STABLE3-1ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.7.STABLE3- 1ubuntu2.1_amd64.deb

Debian Linux 4.0 ia-64

• Debian squid3-cgi_3.0.PRE5-5+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch1_ia64.deb


• Debian squid3-client_3.0.PRE5-5+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch1_ia64.deb


• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb


• Debian squid3_3.0.PRE5-5+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch1_ia64.deb

Debian Linux 4.0 mips

• Debian squid3-common_3.0.PRE5-5+etch1_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch1_all.deb

Squid Web Proxy Cache HTTP Version Number Parsing Denial of Service Vulnerability

References:

• Squid Web Proxy Cache Homepage (Squid)
  
• Squid Proxy Cache Denial of Service in request handling (Amos Jeffries )
  
• Squid Proxy Cache Security Update Advisory SQUID-2009:1 (Squid)