PT-2009-6053 · Squid+1 · Squid+1

Published 2009-10-28 · Updated 2024-06-15 · CVE-2009-3826

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions squidGuard version 1.4

Description The issue is related to multiple buffer overflows that allow remote attackers to bypass intended URL blocking via a long URL. This is connected to the relationship between buffer sizes in squidGuard and Squid, as well as redirect URLs containing information about originally requested URLs.

Recommendations For squidGuard version 1.4, consider restricting access to long URLs as a temporary workaround until a patch is available. Additionally, review and adjust buffer size configurations to prevent overflows.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-3826

DSA-2040-1

OPENSUSE-SU-2024:10562-1

Affected Products

Squid

Squidguard

References · 19

• http://vupen.com/english/advisories/2009/3013 · Vendor Advisory
• http://securityfocus.com/bid/36800 · Patch
• http://secunia.com/advisories/37107 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-3826 · Vendor Advisory
• http://debian.org/security/2010/dsa-2040 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Vendor Advisory
• http://squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10562-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3826 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3826 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-3826 · Vendor Advisory
• http://securityfocus.com/archive/1/507440/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53922 · Note
• https://suse.com/security/cve/CVE-2009-3700 · Note
• http://osvdb.org/59164 · Note