PT-2009-5959 · Squidguard · Squidguard

Publicado 2009-10-28 · Atualizado 2024-06-15 · CVE-2009-3700

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions squidGuard versions 1.3 through 1.4

Description The issue is related to a buffer overflow in the sgLog.c file, which can be triggered by remote attackers sending a long URL containing many / (slash) characters. This can cause the application to hang or lose its blocking functionality, particularly when it enters "emergency mode."

Recommendations For squidGuard versions 1.3 through 1.4, consider restricting access to long URLs or limiting the number of / (slash) characters allowed in URLs as a temporary workaround until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-3700

DSA-2040-1

OPENSUSE-SU-2024:10562-1

Produtos afetados

Squidguard

Referências · 19

• http://osvdb.org/59163 · Nota
• http://vupen.com/english/advisories/2009/3013 · Aviso do Fabricante
• http://securityfocus.com/bid/36800 · Correção
• http://secunia.com/advisories/37107 · Aviso do Fabricante
• http://securityfocus.com/archive/1/507440/100/0/threaded · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3700 · Aviso do Fabricante
• http://squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091015 · Aviso do Fabricante
• http://debian.org/security/2010/dsa-2040 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2009-3700 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3700 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2009-3700 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10562-1 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53921 · Nota
• http://securitytracker.com/id?1023079 · Nota