CVE-2007-0247: Medium severity Squid Squid vulnerability
Published Jan 16, 2007
·Updated
squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses, possibly related to the (1) ftpListingFinish and (2) ftpHtmlifyListEntry functions.
Affected Software
6 affected components
Squid Squid=2.6.stable5
Squid Squid=2.6.stable6
Squid Squid=2.6.stable2
Squid Squid=2.6.stable4
Squid Squid=2.6.stable3
Squid Squid=2.6.stable1
Event History
Jan 16, 2007
CVE Published
06:28 PM
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-0247?
CVE-2007-0247 is classified as a denial of service vulnerability.
2
How do I fix CVE-2007-0247?
To fix CVE-2007-0247, update to Squid version 2.6.STABLE7 or later.
3
Which versions of Squid are affected by CVE-2007-0247?
CVE-2007-0247 affects Squid versions 2.6.STABLE1 through 2.6.STABLE6.
4
What could happen if my system is vulnerable to CVE-2007-0247?
If vulnerable, your system may experience a denial of service due to core dumps triggered by malicious FTP responses.
5
Is there a workaround for CVE-2007-0247 if I cannot upgrade?
A recommended workaround is to restrict access to the FTP feature in your Squid configuration until an upgrade is possible.