Vulnerability Note VU#232881

Squid remote denial-of-service vulnerability

Original Release date: 10 Dec 2007 | Last revised: 18 Jan 2008

Overview

The Squid Proxy server contains a vulnerability that may allow an attacker to create a denial-of-service condition that affects the Squid server and systems that rely on it.

Description

Squid Proxy Cache is a caching proxy that supports the HTTP, HTTPS, and FTP protocols. Squid can also be deployed as a reverse proxy.

From Squid Proxy Cache Security Update Advisory SQUID-2007:2

    Due to incorrect bounds checking Squid is vulnerable to a denial of service check during some cache update reply processing.
This incorrect bounds checking occurs within the httpHeaderUpdate() function when processing cache update replies.

Impact

An attacker who can access the Squid proxy may be able to cause the proxy server to crash. If the Squid proxy is deployed as a reverse proxy, the web servers relying on the proxy may also be affected.

Solution

Update
The Squid team has released patches 11780 and 11211 to address this issue. Administrators who obtain Squid from their operating system vendor should see the systems affected portion of this document for a partial list of affected vendors.


Restrict access

Restricting access to the Squid proxy via access control lists or firewall rules may prevent this vulnerability from being exploited by remote attackers..

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
IPCopAffected10 Dec 200711 Dec 2007
Red Hat, Inc.Affected10 Dec 200711 Dec 2007
SquidAffected-10 Dec 2007
SUSE LinuxAffected10 Dec 200718 Jan 2008
Apple Computer, Inc.Not Affected10 Dec 200711 Dec 2007
Microsoft CorporationNot Affected10 Dec 200711 Dec 2007
NetBSDNot Affected10 Dec 200711 Dec 2007
Openwall GNU/*/LinuxNot Affected10 Dec 200711 Dec 2007
Slackware Linux Inc.Not Affected10 Dec 200710 Dec 2007
Conectiva Inc.Unknown10 Dec 200710 Dec 2007
Cray Inc.Unknown10 Dec 200710 Dec 2007
Debian GNU/LinuxUnknown10 Dec 200710 Dec 2007
EMC CorporationUnknown10 Dec 200710 Dec 2007
Engarde Secure LinuxUnknown10 Dec 200710 Dec 2007
F5 Networks, Inc.Unknown10 Dec 200710 Dec 2007
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The Squid proxy team credits the Wikimedia Foundation for discovering this vulnerability. Adrian Chadd and Henrik Nordstrom are credited for authoring patches that address the issue.

This document was written by Ryan Giobbi.

Other Information

  • CVE IDs: CVE-2007-6239
  • Date Public: 27 Nov 2007
  • Date First Published: 10 Dec 2007
  • Date Last Updated: 18 Jan 2008
  • Severity Metric: 7.51
  • Document Revision: 12

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.