PT-2007-7128 · Squid+1 · Squid+2

Publicado 2007-12-04 · Atualizado 2017-09-29 · CVE-2007-6239

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid versions 2.x through 2.6.STABLE16 Squid version 3.0

Description The issue is related to the "cache update reply processing" functionality, which allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.

Recommendations For Squid versions 2.x through 2.6.STABLE16, update to version 2.6.STABLE17 or later. For Squid version 3.0, update to a version later than 3.0.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-6239

DSA-1482-1

DSA-1646-2

RHSA-2007:1130

RHSA-2007_1130

Produtos afetados

Red Hat

Squid

Squid Cache

Referências · 33

• 🔥 http://squid-cache.org/Versions/v2/2.6/changesets/11780.patch · Exploit
• http://secunia.com/advisories/28412 · Aviso do Fabricante
• http://secunia.com/advisories/28091 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2007-December/msg00497.html · Aviso do Fabricante
• http://secunia.com/advisories/28814 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2007-6239 · Aviso do Fabricante
• http://bugs.gentoo.org/show_bug.cgi?id=201209 · Nota
• http://debian.org/security/2008/dsa-1482 · Correção, Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-6239 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2007:1130 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2007-1130.html · Correção, Aviso do Fabricante
• http://secunia.com/advisories/28350 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2008:002 · Aviso do Fabricante
• http://securityfocus.com/bid/26687 · Correção