CVE-2010-0308: Input Validation
lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0308?
The severity of CVE-2010-0308 is considered high as it allows remote attackers to cause a denial of service through crafted DNS packets.
How do I fix CVE-2010-0308?
To fix CVE-2010-0308, upgrade to a patched version of Squid that addresses the vulnerability, such as Squid 3.1.0.16 or later.
Which versions of Squid are affected by CVE-2010-0308?
CVE-2010-0308 affects Squid versions 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15.
What type of attack does CVE-2010-0308 enable?
CVE-2010-0308 enables a denial of service attack by triggering an assertion failure in the Squid proxy server.
Are there any workarounds for CVE-2010-0308?
Temporary workarounds for CVE-2010-0308 include filtering out malicious DNS packets, but the best practice is to apply the software updates.