PT-2002-1157 · Squid · Squid+1

Published 2002-03-08 · Updated 2016-10-18 · CVE-2002-0068

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Squid versions 2.4 STABLE3 and earlier

Description The issue allows remote attackers to cause a denial of service, potentially leading to a core dump, and may also enable the execution of arbitrary code. This can be achieved by using an ftp:// URL that contains a large number of special characters. When Squid attempts to URL-escape these characters, the buffer can be exceeded.

Recommendations For Squid versions 2.4 STABLE3 and earlier, consider restricting access to ftp:// URLs or limiting the number of special characters allowed in URLs as a temporary mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-0068

Affected Products

Squid

Squid Cache

References · 17

• 🔥 https://exploit-db.com/exploits/21297 · Exploit
• 🔥 http://squid-cache.org/Versions/v2/2.4/bugs · Exploit
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0068 · Security Note
• http://redhat.com/support/errata/RHSA-2002-029.html · Vendor Advisory
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-016.php · Vendor Advisory
• http://caldera.com/support/security/advisories/CSSA-2002-010.0.txt · Vendor Advisory
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:12.squid.asc · Vendor Advisory
• http://novell.com/linux/security/advisories/2002_008_squid_txt.html · Vendor Advisory
• http://archives.neohapsis.com/archives/linux/caldera/2002-q1/0014.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0068 · Note
• http://marc.info/?l=bugtraq&m=101443252627021&w=2 · Note
• http://marc.info/?l=bugtraq&m=101440163111826&w=2 · Note
• http://iss.net/security_center/static/8258.php · Note
• http://securityfocus.com/bid/4148 · Note