CVE-2011-3205: Buffer Overflow
A flaw was reported [1] in how Squid parsed responses from Gopher servers. This flaw could result in a buffer overflow if a Gopher server were to return a line longer than 4096 bytes, leading to memory corruption and a crash. This flaw is an extension of SQUID-2005:1 (or CVE-2005-0094) in Squid 3.x, due to increased packet read sizes. A malicious user could setup a fake Gopher server and forward requests to it through Squid. A specially crafted response from that server could cause Squid to restart.
This has been corrected in upstream versions 3.2.0.11, 3.1.15, and 3.0.STABLE26. Patches for 3.0 [2], 3.1 [3], and 3.2 [4] are available.
[1] http://www.squid-cache.org/Advisories/SQUID-20113.txt [2] http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch [3] http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch [4] http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch
Other sources
Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3205?
CVE-2011-3205 has a high severity due to potential buffer overflow leading to memory corruption and crashes.
What versions are affected by CVE-2011-3205?
CVE-2011-3205 affects multiple versions of Squid including 3.0.stable1 through 3.0.stable24 and several 3.1.x versions.
How do I fix CVE-2011-3205?
To fix CVE-2011-3205, upgrade to a version of Squid that is not affected by this vulnerability.
What type of vulnerability is CVE-2011-3205?
CVE-2011-3205 is a buffer overflow vulnerability affecting Squid proxy server's handling of Gopher responses.
What are the potential impacts of CVE-2011-3205?
The potential impacts of CVE-2011-3205 include crashes of the Squid service and possible exploitation leading to arbitrary code execution.