PT-2007-7533 · Squid · Squid+1

David Duncan Ross Palmer + 1 · Published 1970-01-01 · Updated 2017-07-29 · CVE-2007-0247

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid versions prior to 2.6.STABLE7

Description The issue concerns multiple vulnerabilities in the Squid package that can lead to a disruption in the availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service. Specifically, the ftpListingFinish and ftpHtmlifyListEntry functions in squid/src/ftp.c are affected, allowing remote FTP servers to cause a core dump via crafted FTP directory listing responses.

Recommendations For Squid versions prior to 2.6.STABLE7, update to version 2.6.STABLE7 or later to resolve the issue. As a temporary workaround, consider restricting access to the ftpListingFinish and ftpHtmlifyListEntry functions until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-04631

BDU:2015-04955

CVE-2007-0247

Affected Products

Squid

Squid Cache

References · 28

• 🔥 https://exploit-db.com/exploits/29473 · Exploit
• https://bdu.fstec.ru/vul/2015-04631 · Security Note
• http://secunia.com/advisories/23810 · Vendor Advisory
• http://secunia.com/advisories/23921 · Vendor Advisory
• http://ubuntu.com/usn/usn-414-1 · Vendor Advisory
• http://vupen.com/english/advisories/2007/0199 · Vendor Advisory
• http://trustix.org/errata/2007/0003 · Vendor Advisory
• http://fedoranews.org/cms/node/2442 · Vendor Advisory
• http://secunia.com/advisories/23837 · Vendor Advisory
• http://secunia.com/advisories/23889 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-0247 · Vendor Advisory
• http://secunia.com/advisories/23767 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-0247 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_12_squid.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04955 · Security Note