PT-2007-7534 · Squid · Squid+1

Erick Dantas Rotole + 1 · Published 1970-01-01 · Updated 2017-07-29 · CVE-2007-0248

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid versions prior to 2.6.STABLE7

Description The issue allows remote attackers to cause a denial of service, potentially leading to a disruption in the availability of protected information. This can be achieved by overloading the external acl queue, which triggers an infinite loop in the aclMatchExternal function. The exploitation of this issue can be done remotely.

Recommendations For Squid versions prior to 2.6.STABLE7, update to version 2.6.STABLE7 or later to resolve the issue. As a temporary workaround, consider restricting access to the aclMatchExternal function to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-04631

BDU:2015-04955

CVE-2007-0248

Affected Products

Squid

Squid Cache

References · 22

• https://bdu.fstec.ru/vul/2015-04631 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-0248 · Vendor Advisory
• http://ubuntu.com/usn/usn-414-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-0248 · Vendor Advisory
• http://secunia.com/advisories/23767 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-0248 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_12_squid.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04955 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2007:026 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200701-22.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0248 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31525 · Note
• http://secunia.com/advisories/23805 · Note
• http://securityfocus.com/bid/22203 · Note
• http://squid-cache.org/Versions/v2/2.6/squid-2.6.STABLE7-RELEASENOTES.html#s12 · Note