Squid Proxy String Processing NULL Pointer Dereference Denial Of Service Vulnerability

Bugtraq ID:	42982
Class:	Unknown
CVE:	CVE-2010-3072
Remote:	Yes
Local:	No
Published:	Sep 03 2010 12:00AM
Updated:	Apr 13 2015 09:21PM
Credit:	Phil Oester
Vulnerable:	Squid Web Proxy Cache 3.1 .5 Squid Web Proxy Cache 3.1 .4 Squid Web Proxy Cache 3.0 PRE3 Squid Web Proxy Cache 3.0 PRE2 Squid Web Proxy Cache 3.0 PRE1 Squid Web Proxy Cache 3.0 Squid Web Proxy Cache 3.2.0.1 Squid Web Proxy Cache 3.2 Squid Web Proxy Cache 3.1.7 Squid Web Proxy Cache 3.1.6 Squid Web Proxy Cache 3.1.0.16 Squid Web Proxy Cache 3.1.0.15 Squid Web Proxy Cache 3.1.0.12 Squid Web Proxy Cache 3.1.0.11 Squid Web Proxy Cache 3.1 Squid Web Proxy Cache 3.0.STABLE7 Squid Web Proxy Cache 3.0.STABLE6 Squid Web Proxy Cache 3.0.STABLE5 Squid Web Proxy Cache 3.0.STABLE4 Squid Web Proxy Cache 3.0.STABLE3 Squid Web Proxy Cache 3.0.STABLE25 Squid Web Proxy Cache 3.0.STABLE24 Squid Web Proxy Cache 3.0.STABLE23 Squid Web Proxy Cache 3.0.STABLE22 Squid Web Proxy Cache 3.0.STABLE21 Squid Web Proxy Cache 3.0.STABLE2 Squid Web Proxy Cache 3.0.STABLE17 Squid Web Proxy Cache 3.0.STABLE16 Squid Web Proxy Cache 3.0.STABLE13 Squid Web Proxy Cache 3.0.STABLE12 Squid Web Proxy Cache 3.0.STABLE1 S.u.S.E. openSUSE 11.3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server 6 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	Squid Web Proxy Cache 3.1.8 Squid Web Proxy Cache 3.2.0.2

Squid Proxy String Processing NULL Pointer Dereference Denial Of Service Vulnerability

Squid is prone to a remote denial-of-service vulnerability caused by a NULL pointer dereference.

An attacker can exploit this issue to cause the application to crash, denying service to legitimate users. Due to the nature of the issue, code execution may be possible; however, it has not been confirmed.

The issue affects the following versions:

Squid 3.0 to 3.0.STABLE25
Squid 3.1 to 3.1.7
Squid 3.2 to 3.2.0.1

Squid Proxy String Processing NULL Pointer Dereference Denial Of Service Vulnerability

An attacker can use readily available tools to exploit this issue.

Squid Proxy String Processing NULL Pointer Dereference Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 ia-64

• Debian squid3-cgi_3.0.STABLE8-3+lenny4_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny4_ia64.deb


• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb


• Debian squid3_3.0.STABLE8-3+lenny4_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny4_ia64.deb


• Debian squidclient_3.0.STABLE8-3+lenny4_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny4_ia64.deb

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva squid-3.0-22.4mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-22.4mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva squid-3.0-22.4mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-22.4mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 alpha

• Debian squid3-cgi_3.0.STABLE8-3+lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny4_alpha.deb


• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb


• Debian squid3_3.0.STABLE8-3+lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny4_alpha.deb


• Debian squidclient_3.0.STABLE8-3+lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny4_alpha.deb

Debian Linux 5.0 ia-32

• Debian squid3-cgi_3.0.STABLE8-3+lenny4_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny4_i386.deb


• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb


• Debian squid3_3.0.STABLE8-3+lenny4_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny4_i386.deb


• Debian squidclient_3.0.STABLE8-3+lenny4_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny4_i386.deb

MandrakeSoft Enterprise Server 5

• Mandriva squid-3.0-22.4mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-22.4mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 s/390

• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva squid-3.1-14.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.1-14.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 mipsel

• Debian squid3-cgi_3.0.STABLE8-3+lenny4_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny4_mipsel.deb


• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb


• Debian squid3_3.0.STABLE8-3+lenny4_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny4_mipsel.deb


• Debian squidclient_3.0.STABLE8-3+lenny4_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny4_mipsel.deb

Mandriva Linux Mandrake 2010.0

• Mandriva squid-3.0-22.4mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-22.4mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva squid-3.0-22.4mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-22.4mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 hppa

• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb

Debian Linux 5.0 m68k

• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb

Mandriva Linux Mandrake 2010.1

• Mandriva squid-3.1-14.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.1-14.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 arm

• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb

Mandriva Linux Mandrake 2009.0

• Mandriva squid-3.0-22.4mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-22.4mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 armel

• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb

Debian Linux 5.0

• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb

Debian Linux 5.0 amd64

• Debian squid3-cgi_3.0.STABLE8-3+lenny4_amd64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny4_amd64.deb


• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb


• Debian squid3_3.0.STABLE8-3+lenny4_amd64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny4_amd64.deb


• Debian squidclient_3.0.STABLE8-3+lenny4_amd64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny4_amd64.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva squid-3.0-22.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-22.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 mips

• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb

Debian Linux 5.0 powerpc

• Debian squid3-cgi_3.0.STABLE8-3+lenny4_powerpc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny4_powerpc.deb


• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb


• Debian squid3_3.0.STABLE8-3+lenny4_powerpc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny4_powerpc.deb


• Debian squidclient_3.0.STABLE8-3+lenny4_powerpc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny4_powerpc.deb

Mandriva Linux Mandrake 2009.1

• Mandriva squid-3.0-22.4mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-3.0-22.4mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 sparc

• Debian squid3-cgi_3.0.STABLE8-3+lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny4_sparc.deb


• Debian squid3-common_3.0.STABLE8-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny4_all.deb


• Debian squid3_3.0.STABLE8-3+lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny4_sparc.deb


• Debian squidclient_3.0.STABLE8-3+lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny4_sparc.deb

Squid Proxy String Processing NULL Pointer Dereference Denial Of Service Vulnerability

References:

• Squid Proxy Cache Security Update Advisory SQUID-2010:3 (Squid)