Squid Proxy Cache ICAP Adaptation Denial of Service Vulnerability
BID:34277
Info
Squid Proxy Cache ICAP Adaptation Denial of Service Vulnerability
| Bugtraq ID: | 34277 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 27 2009 12:00AM |
| Updated: | Mar 27 2009 09:26PM |
| Credit: | Martin Huter |
| Vulnerable: |
Squid Web Proxy Cache 3.1 .5 Squid Web Proxy Cache 3.1 .4 Squid Web Proxy Cache 3.0 PRE3 Squid Web Proxy Cache 3.0 PRE2 Squid Web Proxy Cache 3.0 PRE1 Squid Web Proxy Cache 3.0 Squid Web Proxy Cache 3.1 Squid Web Proxy Cache 3.0.STABLE7 Squid Web Proxy Cache 3.0.STABLE6 Squid Web Proxy Cache 3.0.STABLE5 Squid Web Proxy Cache 3.0.STABLE4 Squid Web Proxy Cache 3.0.STABLE3 Squid Web Proxy Cache 3.0.STABLE2 Squid Web Proxy Cache 3.0.STABLE13 Squid Web Proxy Cache 3.0.STABLE12 Squid Web Proxy Cache 3.0.STABLE1 |
| Not Vulnerable: | |
Discussion
Squid Proxy Cache ICAP Adaptation Denial of Service Vulnerability
Squid is prone to a remote denial-of-service vulnerability because the proxy server fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer.
Successfully exploiting this issue allows remote attackers to consume excessive memory, resulting in a denial-of-service condition.
Note that to exploit this issue, an attacker must be a legitimate client user of the proxy.
The Squid 3.x branch is vulnerable.
Squid is prone to a remote denial-of-service vulnerability because the proxy server fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer.
Successfully exploiting this issue allows remote attackers to consume excessive memory, resulting in a denial-of-service condition.
Note that to exploit this issue, an attacker must be a legitimate client user of the proxy.
The Squid 3.x branch is vulnerable.
Exploit / POC
Squid Proxy Cache ICAP Adaptation Denial of Service Vulnerability
Attackers can use readily available tools to exploit this issue.
Attackers can use readily available tools to exploit this issue.
Solution / Fix
Squid Proxy Cache ICAP Adaptation Denial of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Squid Proxy Cache ICAP Adaptation Denial of Service Vulnerability
References:
References:
- Bugzilla Bug 2619: ICAP adaptation: missing data flow control to client side (Martin Huter)
- Squid Web Proxy Cache Homepage (Squid)
- ICAP adaptation: missing data flow control to client side (Martin Huter