PT-2009-5022 · Squid · Squid+1

Rob Middleton · Published 2009-07-28 · Updated 2009-08-12 · CVE-2009-2622

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid versions 3.0 through 3.0.STABLE16 Squid versions 3.1 through 3.1.0.11

Description The issue allows remote attackers to cause a denial of service via malformed requests, including missing or mismatched protocol identifiers, missing or negative status values, missing versions, or missing or invalid status numbers. This is related to the HttpMsg.cc and HttpReply.cc components.

Recommendations For Squid versions 3.0 through 3.0.STABLE16, update to a version later than 3.0.STABLE16 to resolve the issue. For Squid versions 3.1 through 3.1.0.11, update to a version later than 3.1.0.11 to resolve the issue.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-2622

DSA-1843-1

DSA-1843-2

Affected Products

Squid

Squid Cache

References · 10

• http://mandriva.com/security/advisories?name=MDVSA-2009:178 · Vendor Advisory
• http://squid-cache.org/Versions/v3/3.1/changesets/b9661.patch · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2622 · Security Note
• http://squid-cache.org/Advisories/SQUID-2009_2.txt · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2622 · Note
• http://securitytracker.com/id?1022607 · Note
• http://vupen.com/english/advisories/2009/2013 · Note
• http://securityfocus.com/bid/35812 · Note
• http://secunia.com/advisories/36007 · Note