CVE-2004-2654: Buffer Overflow
The clientAbortBody function in clientside.c in Squid Web Proxy Cache before 2.6 STABLE6 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors that trigger a null dereference. NOTE: in a followup advisory, a researcher claimed that the issue was a buffer overflow that was not fixed in STABLE6. However, the vendor's bug report clearly shows that the researcher later retracted this claim, because the tested product was actually STABLE5.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-2654?
CVE-2004-2654 has a severity rating that indicates it can lead to a significant denial of service due to a segmentation fault.
How do I fix CVE-2004-2654?
To fix CVE-2004-2654, upgrade to a patched version of Squid Web Proxy Cache that is not affected by this vulnerability.
What versions of Squid are affected by CVE-2004-2654?
CVE-2004-2654 affects Squid versions prior to 2.6 STABLE6, specifically including version 2.5 STABLE5.
What types of attacks exploit CVE-2004-2654?
CVE-2004-2654 can be exploited by remote attackers to induce a denial of service via unspecified vectors triggering a null dereference.
Is CVE-2004-2654 still a prevalent issue today?
While CVE-2004-2654 is an older vulnerability, any systems still running the affected versions of Squid remain at risk unless properly updated.