CVE-2009-0478: Input Validation
A denial of service flaw was found in the way squid handles certain client initiated requests. A client who can connect to the squid server could leverage this flaw to cause the squid child process to terminate. This would prevent anyone from using the squid server until the process automatically restarts.
Other sources
Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict which clients can connect to the Squid server: use network- or host-based firewalls/ACLs to allow only trusted IP ranges to reach the Squid service, blocking general internet access to the proxy.
- Operational
Implement process supervision and alerting for Squid: configure a supervisor (for example systemd, monit, or similar) to detect termination of Squid child processes and automatically restart them, and generate alerts on such terminations so operators can investigate.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0478?
CVE-2009-0478 is classified as a denial of service vulnerability.
How do I fix CVE-2009-0478?
To fix CVE-2009-0478, upgrade to a patched version of Squid, specifically updates beyond 3.0.STABLE13.
Which versions of Squid are affected by CVE-2009-0478?
CVE-2009-0478 affects Squid versions 2.7.stable1 through 2.7.stable5 and 3.0.stable1 through 3.0.stable12.
Can CVE-2009-0478 allow remote users to crash the Squid server?
Yes, CVE-2009-0478 allows remote users to crash the Squid server through specially crafted requests.
What type of applications are impacted by CVE-2009-0478?
CVE-2009-0478 impacts applications using Squid as a proxy, potentially leading to service interruption.