PT-2013-4858 · Squid · Squid+1

Published 2013-07-21 · Updated 2018-10-30 · CVE-2013-4123

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Squid versions 3.2.x through 3.2.12 Squid versions 3.3.x through 3.3.7

Description The issue allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header. This is related to the client side request.cc file.

Recommendations For Squid versions 3.2.x through 3.2.12, update to version 3.2.13 or later. For Squid versions 3.3.x through 3.3.7, update to version 3.3.8 or later.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-4123

MGASA-2013-0228

Affected Products

Squid

Squid Cache

References · 15

• 🔥 https://exploit-db.com/exploits/26886 · Exploit
• http://lists.opensuse.org/opensuse-updates/2013-09/msg00024.html · Vendor Advisory
• http://squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11826.patch · Patch
• http://squid-cache.org/Advisories/SQUID-2013_3.txt · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0228.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-4123 · Security Note
• http://secunia.com/advisories/54142 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0228 · Vendor Advisory
• http://squid-cache.org/Versions/v3/3.3/changesets/squid-3.3-12591.patch · Note
• http://squid-cache.org/Advisories/SQUID-2013_2.txt · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4123 · Note
• ftp://ftp.fu-berlin.de/unix/www/squid/archive/3.2/squid-3.2.0.9-RELEASENOTES.html#ss2.4 · Note
• https://bugs.mageia.org/show_bug.cgi?id=10516 · Note
• http://secunia.com/advisories/54834 · Note
• http://squid-cache.org/Doc/man · Note