PT-2005-1277 · Squid · Squid+1

Publicado 2005-02-06 · Atualizado 2016-10-18 · CVE-2005-0194

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Squid version 2.5

Description The issue arises when Squid processes its configuration file, specifically with empty Access Control Lists (ACLs), including proxy auth ACLs that lack defined authentication schemes. This parsing behavior can remove arguments, potentially allowing remote attackers to bypass intended ACLs if the administrator disregards parser warnings.

Recommendations For Squid version 2.5, ensure that all Access Control Lists (ACLs), especially proxy auth ACLs, have defined authentication schemes to prevent the removal of arguments during configuration file processing. Define proper auth schemes for proxy auth ACLs to maintain the integrity of intended ACLs.

Correção

Identificadores relacionados

CVE-2005-0194

DSA-667-1

Produtos afetados

Squid

Squid Cache

Referências · 13

• http://kb.cert.org/vuls/id/260421 · Correção
• http://squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-empty_acls.patch · Correção
• http://debian.org/security/2005/dsa-667 · Aviso do Fabricante
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000923 · Correção, Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0194 · Nota
• https://osv.dev/vulnerability/CVE-2005-0194 · Aviso do Fabricante
• http://squid-cache.org/bugs/show_bug.cgi?id=1166 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=110901183320453&w=2 · Nota
• http://fedoranews.org/updates/FEDORA--.shtml · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-0194 · Nota de Segurança
• http://squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_acls · Correção
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0194 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2005-0194 · Aviso do Fabricante