PT-2010-2099 · Squid+1 · Squid+2

Tomas Hoger · Published 2010-02-03 · Updated 2017-09-19 · CVE-2010-0308

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid versions 2.x, 3.0 through 3.0.STABLE22, 3.1 through 3.1.0.15

Description The issue allows remote attackers to cause a denial of service via a crafted DNS packet that only contains a header, leading to an assertion failure in the lib/rfc1035.c file.

Recommendations For Squid versions 2.x, update to a version outside of the affected range to resolve the issue. For Squid versions 3.0 through 3.0.STABLE22, update to a version outside of the affected range to resolve the issue. For Squid versions 3.1 through 3.1.0.15, update to a version outside of the affected range to resolve the issue.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-0308

DSA-1991-1

RHSA-2010:0221

RHSA-2010_0221

Affected Products

Red Hat

Squid

Squid Cache

References · 21

• http://vupen.com/english/advisories/2010/0260 · Vendor Advisory
• http://secunia.com/advisories/38455 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-0308 · Vendor Advisory
• http://squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9163.patch · Patch
• http://secunia.com/advisories/38451 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-0308 · Vendor Advisory
• http://squid-cache.org/Advisories/SQUID-2010_1.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-0308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0308 · Security Note
• http://osvdb.org/62044 · Note
• http://securityfocus.com/bid/37522 · Note
• http://securitytracker.com/id?1023520 · Note
• https://access.redhat.com/errata/RHSA-2010:0221 · Note
• http://squid-cache.org/Versions/v2/HEAD/changesets/12597.patch · Note
• https://access.redhat.com/security/cve/CVE-2009-2855 · Note