PT-2010-4429 · Squid · Squid+1

Jan Lieskovsky · Published 2010-10-12 · Updated 2010-10-13 · CVE-2010-2951

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid version 3.1.6

Description The issue allows remote attackers to cause a denial of service, resulting in an assertion failure and daemon exit. This occurs when the dns internal.cc component accesses an invalid socket during an IPv4 TCP DNS query, specifically when IPv6 DNS resolution is not enabled. The attack vectors involve triggering an IPv4 DNS response with the TC bit set.

Recommendations For Squid version 3.1.6, consider updating to a newer version that addresses this issue, as the current version can be exploited to cause a denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2010-2951

Affected Products

Squid

Squid Cache

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2010-2951 · Security Note
• http://bazaar.launchpad.net/~squid/squid/3.1/revision/10072 · Patch
• http://squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10072.patch · Patch
• http://marc.info/?l=squid-users&m=128263555724981&w=2 · Vendor Advisory
• http://openwall.com/lists/oss-security/2010/08/25/2 · Patch
• http://bugs.gentoo.org/show_bug.cgi?id=334263 · Note
• http://openwall.com/lists/oss-security/2010/08/24/6 · Note
• http://openwall.com/lists/oss-security/2010/08/24/7 · Note
• http://openwall.com/lists/oss-security/2010/08/25/6 · Note
• http://bugs.squid-cache.org/show_bug.cgi?id=3009 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2951 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=626927 · Note
• http://bugs.squid-cache.org/show_bug.cgi?id=3021 · Note