PT-2010-4526 · Squid+1 · Squid+2

Phil Oester · Published 2010-09-20 · Updated 2011-05-19 · CVE-2010-3072

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid versions 3.0.0 through 3.1.7 Squid versions 3.2.0 through 3.2.0.1

Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, by sending a crafted request. This is due to a problem in the string-comparison functions.

Recommendations For Squid versions 3.0.0 through 3.1.7, update to version 3.1.8 or later. For Squid versions 3.2.0 through 3.2.0.1, update to version 3.2.0.2 or later.

Fix

Related Identifiers

CVE-2010-3072

DSA-2111-1

RHSA-2011:0545

RHSA-2011_0545

Affected Products

Red Hat

Squid

Squid Cache

References · 20

• http://openwall.com/lists/oss-security/2010/09/07/7 · Patch
• http://secunia.com/advisories/41477 · Vendor Advisory
• http://secunia.com/advisories/41298 · Vendor Advisory
• http://debian.org/security/2010/dsa-2111 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-0545.html · Vendor Advisory
• http://squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10090.patch · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047787.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=630444 · Patch
• http://squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9189.patch · Patch
• http://openwall.com/lists/oss-security/2010/09/05/2 · Patch
• http://squid-cache.org/Advisories/SQUID-2010_3.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3072 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047820.html · Vendor Advisory
• http://securityfocus.com/bid/42982 · Note