PT-2007-7128 · Squid+1 · Squid+2

Published 2007-12-04 · Updated 2017-09-29 · CVE-2007-6239

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid versions 2.x through 2.6.STABLE16 Squid version 3.0

Description The issue is related to the "cache update reply processing" functionality, which allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.

Recommendations For Squid versions 2.x through 2.6.STABLE16, update to version 2.6.STABLE17 or later. For Squid version 3.0, update to a version later than 3.0.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-6239

DSA-1482-1

DSA-1646-2

RHSA-2007:1130

RHSA-2007_1130

Affected Products

Red Hat

Squid

Squid Cache

References · 33

• 🔥 http://squid-cache.org/Versions/v2/2.6/changesets/11780.patch · Exploit
• http://secunia.com/advisories/28412 · Vendor Advisory
• http://secunia.com/advisories/28091 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2007-December/msg00497.html · Vendor Advisory
• http://secunia.com/advisories/28814 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-6239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6239 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html · Vendor Advisory
• http://secunia.com/advisories/28350 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:002 · Vendor Advisory
• http://securityfocus.com/bid/26687 · Patch
• http://security.gentoo.org/glsa/glsa-200801-05.xml · Vendor Advisory
• http://secunia.com/advisories/28381 · Vendor Advisory
• http://secunia.com/advisories/34467 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6239 · Vendor Advisory