PT-2005-1277 · Squid · Squid+1

Published 2005-02-06 · Updated 2016-10-18 · CVE-2005-0194

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Squid version 2.5

Description The issue arises when Squid processes its configuration file, specifically with empty Access Control Lists (ACLs), including proxy auth ACLs that lack defined authentication schemes. This parsing behavior can remove arguments, potentially allowing remote attackers to bypass intended ACLs if the administrator disregards parser warnings.

Recommendations For Squid version 2.5, ensure that all Access Control Lists (ACLs), especially proxy auth ACLs, have defined authentication schemes to prevent the removal of arguments during configuration file processing. Define proper auth schemes for proxy auth ACLs to maintain the integrity of intended ACLs.

Fix

Related Identifiers

CVE-2005-0194

DSA-667-1

Affected Products

Squid

Squid Cache

References · 13

• http://kb.cert.org/vuls/id/260421 · Patch
• http://squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-empty_acls.patch · Patch
• http://debian.org/security/2005/dsa-667 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-0194 · Vendor Advisory
• http://squid-cache.org/bugs/show_bug.cgi?id=1166 · Vendor Advisory
• http://fedoranews.org/updates/FEDORA--.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0194 · Security Note
• http://squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_acls · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0194 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-0194 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000923 · Patch, Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0194 · Note
• http://marc.info/?l=bugtraq&m=110901183320453&w=2 · Note