CVE-2012-5643: Input Validation
A denial of service flaw was found in the way the CGI Cache Manager of the Squid proxy caching server processed certain requests. A remote attacker could this this flaw to cause the squid service to consume excessive amount of resources.
References: [1] http://www.squid-cache.org/Advisories/SQUID-20121.txt [2] https://bugs.gentoo.org/showbug.cgi?id=447596 [3] https://secunia.com/advisories/51545/
Upstream patches: [4] http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch (against the 3.1 branch) [5] http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch (against the 3.2 branch)
Other sources
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5643?
CVE-2012-5643 has a severity rating that points to it being a denial of service vulnerability affecting the Squid proxy caching server.
How do I fix CVE-2012-5643?
To fix CVE-2012-5643, update to a patched version of the Squid proxy server that resolves this denial of service vulnerability.
What versions of Squid are affected by CVE-2012-5643?
CVE-2012-5643 affects multiple versions of Squid, including 2.0 through 2.7 and 3.0 through 3.3.0.1.
What type of attack does CVE-2012-5643 allow?
CVE-2012-5643 allows a remote attacker to exploit the vulnerability to cause excessive resource consumption, leading to denial of service.
Is CVE-2012-5643 present in all Squid versions?
No, CVE-2012-5643 is not present in all Squid versions; specifically, it affects a range of older versions as listed in the advisory.