PT-2010-4429 · Squid · Squid+1

Jan Lieskovsky · Publicado 2010-10-12 · Atualizado 2010-10-13 · CVE-2010-2951

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid version 3.1.6

Description The issue allows remote attackers to cause a denial of service, resulting in an assertion failure and daemon exit. This occurs when the dns internal.cc component accesses an invalid socket during an IPv4 TCP DNS query, specifically when IPv6 DNS resolution is not enabled. The attack vectors involve triggering an IPv4 DNS response with the TC bit set.

Recommendations For Squid version 3.1.6, consider updating to a newer version that addresses this issue, as the current version can be exploited to cause a denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2010-2951

Produtos afetados

Squid

Squid Cache

Referências · 13

• https://nvd.nist.gov/vuln/detail/CVE-2010-2951 · Nota de Segurança
• http://bugs.gentoo.org/show_bug.cgi?id=334263 · Nota
• http://openwall.com/lists/oss-security/2010/08/24/6 · Nota
• http://bazaar.launchpad.net/~squid/squid/3.1/revision/10072 · Correção
• http://openwall.com/lists/oss-security/2010/08/24/7 · Nota
• http://openwall.com/lists/oss-security/2010/08/25/6 · Nota
• http://squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10072.patch · Correção
• http://bugs.squid-cache.org/show_bug.cgi?id=3009 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2951 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=626927 · Nota
• http://bugs.squid-cache.org/show_bug.cgi?id=3021 · Nota
• http://marc.info/?l=squid-users&m=128263555724981&w=2 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2010/08/25/2 · Correção