CVE-2008-1612: Input Validation

Published Apr 1, 2008

Updated

The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17 allows attackers to cause a denial of service (process exit) via unknown vectors that cause an array to shrink to 0 entries, which triggers an assert error. NOTE: this issue is due to an incorrect fix for CVE-2007-6239.

Affected Software

1 affected component

Squid Squid=2.6.stable17

Remediation

Patch Available

http://www.squid-cache.org/Advisories/SQUID-2007_2.txt

Event History

Apr 1, 2008

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-1612?

CVE-2008-1612 is classified as a high-severity vulnerability that can lead to denial of service.

How do I fix CVE-2008-1612?

To fix CVE-2008-1612, upgrade to a version of Squid that is not affected, as the vulnerability exists specifically in Squid 2.6.STABLE17.

What type of vulnerability is CVE-2008-1612?

CVE-2008-1612 is a denial of service vulnerability affecting the arrayShrink function in Squid.

Can CVE-2008-1612 be exploited remotely?

Yes, CVE-2008-1612 can potentially be exploited remotely, leading to a process exit.

What caused the vulnerability in CVE-2008-1612?

CVE-2008-1612 was caused by an incorrect fix for a previous vulnerability, specifically CVE-2007-6239.