CVE-2007-6239: Input Validation
Squid security advisory SQUID-2007:2 was published recently:
http://www.squid-cache.org/Advisories/SQUID-20072.txt
Problem Description:
Due to incorrect bounds checking Squid is vulnerable to a denial of service check during some cache update reply processing.
Severity:
This problem allows any client trusted to use the service to perform a denial of service attack on the Squid service.
Other sources
The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-6239?
CVE-2007-6239 has a severity rating that indicates it can lead to denial of service under specific conditions.
How do I fix CVE-2007-6239?
To fix CVE-2007-6239, upgrade to a patched version of Squid that addresses the bounds checking issue.
Which Squid versions are affected by CVE-2007-6239?
CVE-2007-6239 affects several Squid versions, including 2.0_patch2, 2.1_patch2, and 2.3.stable4 to 3.0_pre3.
What type of vulnerability is CVE-2007-6239?
CVE-2007-6239 is classified as a vulnerability that can result in a denial of service due to improper bounds checking.
Is CVE-2007-6239 actively being exploited?
There is no public information indicating active exploitation of CVE-2007-6239, but it is essential to apply patches promptly.