CVE-2005-0194: Critical severity Squid Squid vulnerability
Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxyauth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-0194?
CVE-2005-0194 has a medium severity rating as it can allow remote attackers to bypass access control lists.
How do I fix CVE-2005-0194?
To fix CVE-2005-0194, ensure that all Access Control Lists in the Squid configuration file are properly defined and avoid leaving any ACLs empty.
Which versions of Squid are affected by CVE-2005-0194?
CVE-2005-0194 affects multiple versions including Squid 2.0.patch1 up to 2.5.stable6.
What is the exploit vector for CVE-2005-0194?
The exploit vector for CVE-2005-0194 is primarily through misconfiguration of empty Access Control Lists in the Squid configuration.
What happens if I ignore the warnings related to CVE-2005-0194?
Ignoring the warnings related to CVE-2005-0194 could lead to unintentional access by remote attackers.