The Squid Proxy server contains a vulnerability that may allow an attacker to create a denial-of-service condition that affects the Squid server and systems that rely on it.
Squid Proxy Cache is a caching proxy that supports the HTTP, HTTPS, and FTP protocols. Squid can also be deployed as a reverse proxy.
From Squid Proxy Cache Security Update Advisory SQUID-2007:2
An attacker who can access the Squid proxy may be able to cause the proxy server to crash. If the Squid proxy is deployed as a reverse proxy, the web servers relying on the proxy may also be affected.
Red Hat, Inc. Affected
SUSE Linux Affected
Apple Computer, Inc. Not Affected
Microsoft Corporation Not Affected
NetBSD Not Affected
Openwall GNU/*/Linux Not Affected
Slackware Linux Inc. Not Affected
Conectiva Inc. Unknown
Cray Inc. Unknown
Debian GNU/Linux Unknown
EMC Corporation Unknown
Engarde Secure Linux Unknown
F5 Networks, Inc. Unknown
Fedora Project Unknown
FreeBSD, Inc. Unknown
Gentoo Linux Unknown
Hewlett-Packard Company Unknown
IBM Corporation Unknown
IBM Corporation (zseries) Unknown
IBM eServer Unknown
Ingrian Networks, Inc. Unknown
Juniper Networks, Inc. Unknown
Mandriva, Inc. Unknown
MontaVista Software, Inc. Unknown
NEC Corporation Unknown
Novell, Inc. Unknown
QNX, Software Systems, Inc. Unknown
Silicon Graphics, Inc. Unknown
Sony Corporation Unknown
Sun Microsystems, Inc. Unknown
The SCO Group Unknown
Trustix Secure Linux Unknown
Wind River Systems, Inc. Unknown
The Squid proxy team credits the Wikimedia Foundation for discovering this vulnerability. Adrian Chadd and Henrik Nordstrom are credited for authoring patches that address the issue.
This document was written by Ryan Giobbi.
|Date First Published:||2007-12-10|
|Date Last Updated:||2008-01-18 16:35 UTC|