CVE-2005-0626: Race Condition
Published Mar 3, 2005
·Updated
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
Affected Software
3 affected components
Squid Squid=2.5.stable5
Squid Squid=2.5.stable6
Squid Squid=2.5.stable7
Event History
Mar 3, 2005
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-0626?
CVE-2005-0626 is classified as a medium severity vulnerability due to the potential for cookie theft.
2
How do I fix CVE-2005-0626?
Fix CVE-2005-0626 by upgrading to a later stable version of Squid that addresses the race condition.
3
What versions of Squid are affected by CVE-2005-0626?
CVE-2005-0626 affects Squid versions 2.5.STABLE7 to 2.5.STABLE9.
4
What are the implications of CVE-2005-0626 for users?
The implications of CVE-2005-0626 include the possibility of attackers stealing cookies, which may lead to session hijacking.
5
Is there a workaround for CVE-2005-0626 if I cannot upgrade?
A recommended workaround for CVE-2005-0626 is disabling cookie caching in Squid until an upgrade is feasible.