CVE-2016-2572: Input Validation
Published Feb 27, 2016
·Updated
http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.
Affected Software
6 affected components
Squid-Cache Squid=4.0.1
Squid-Cache Squid=4.0.2
Squid-Cache Squid=4.0.3
Squid-Cache Squid=4.0.4
Squid-Cache Squid=4.0.5
Squid-Cache Squid=4.0.6
Event History
Feb 27, 2016
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2572?
CVE-2016-2572 has a severity rating of medium, as it can cause denial of service by crashing the Squid daemon.
2
How do I fix CVE-2016-2572?
To fix CVE-2016-2572, upgrade Squid to version 4.0.7 or later.
3
What versions of Squid are affected by CVE-2016-2572?
CVE-2016-2572 affects Squid versions 4.0.1 through 4.0.6.
4
What type of vulnerability is CVE-2016-2572?
CVE-2016-2572 is a denial of service vulnerability caused by handling malformed HTTP responses.
5
Can CVE-2016-2572 be exploited remotely?
Yes, CVE-2016-2572 can be exploited by remote HTTP servers sending malformed responses.