REDHAT-BUG-630444: Low severity Squid Squid vulnerability
A denial of service flaw was found in the way Squid proxy caching server internally processed NULL buffers. A remote, trusted client could use this flaw to cause squid daemon crash (dereference NULL pointer) when processing specially-crafted request.
References: [1] http://www.squid-cache.org/Advisories/SQUID-20103.txt
Upstream patch (against Squid v3.0): [2] http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9189.patch
Upstream patch (against Squid v3.1): [3] http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10090.patch
Credit: The vulnerability was discovered by Phil Oester.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-630444?
The severity of REDHAT-BUG-630444 is categorized as a denial of service vulnerability.
How do I fix REDHAT-BUG-630444?
To fix REDHAT-BUG-630444, update the Squid proxy caching server to a version later than 3.1.
Who is affected by REDHAT-BUG-630444?
REDHAT-BUG-630444 affects users of Squid versions 3.0 and 3.1.
What is the impact of REDHAT-BUG-630444?
The impact of REDHAT-BUG-630444 is that a remote, trusted client can crash the Squid daemon.
Is REDHAT-BUG-630444 easy to exploit?
Yes, REDHAT-BUG-630444 can be exploited by remote users with specially-crafted requests.