REDHAT-BUG-887962
First published: Mon Dec 17 2012(Updated: )
A denial of service flaw was found in the way the CGI Cache Manager of the Squid proxy caching server processed certain requests. A remote attacker could this this flaw to cause the squid service to consume excessive amount of resources. References: [1] <a href="http://www.squid-cache.org/Advisories/SQUID-2012_1.txt">http://www.squid-cache.org/Advisories/SQUID-2012_1.txt</a> [2] <a href="https://bugs.gentoo.org/show_bug.cgi?id=447596">https://bugs.gentoo.org/show_bug.cgi?id=447596</a> [3] <a href="https://secunia.com/advisories/51545/">https://secunia.com/advisories/51545/</a> Upstream patches: [4] <a href="http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch">http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch</a> (against the 3.1 branch) [5] <a href="http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch">http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch</a> (against the 3.2 branch)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Squid Web Proxy Cache | >3.1>3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.squid-cache.org/Advisories/SQUID-2012_1.txt
- https://bugs.gentoo.org/show_bug.cgi?id=447596
- https://secunia.com/advisories/51545/
- http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch
- http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=887964
- http://www.openwall.com/lists/oss-security/2012/12/17/3
- https://access.redhat.com/security/cve/CVE-2012-5643
- http://www.openwall.com/lists/oss-security/2012/12/17/4
- http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID-2012_1.patch
- http://www.squid-cache.org/Versions/v3/3.2/changesets/SQUID-2012_1.patch
- http://bazaar.launchpad.net/~squid/squid/3.1/revision/10479
- http://bazaar.launchpad.net/~squid/squid/3.1/revision/10483
- http://bazaar.launchpad.net/~squid/squid/3.1/revision/10484
- http://bazaar.launchpad.net/~squid/squid/3.2/revision/11714
- http://bazaar.launchpad.net/~squid/squid/3.2/revision/11743
- http://bazaar.launchpad.net/~squid/squid/3.2/revision/11744
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=887962#c9
- https://access.redhat.com/security/cve/CVE-2013-0189
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=895972
- https://rhn.redhat.com/errata/RHSA-2013-0505.html
- http://bazaar.launchpad.net/~squid/squid/3.1/revision/10486
- http://bugs.squid-cache.org/show_bug.cgi?id=3790
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=990186
- https://access.redhat.com/support/policy/updates/errata/
- https://bugzilla.redhat.com/show_bug.cgi?id=887962
Frequently Asked Questions
What is the severity of REDHAT-BUG-887962?
The severity of REDHAT-BUG-887962 is considered high, as it allows for potential denial of service due to resource exhaustion.
How do I fix REDHAT-BUG-887962?
To fix REDHAT-BUG-887962, you should upgrade to a patched version of the Squid proxy caching server that addresses this vulnerability.
What impact does REDHAT-BUG-887962 have on systems?
The impact of REDHAT-BUG-887962 is that a remote attacker can exploit this flaw to disrupt service by exhausting system resources.
Which versions of Squid are affected by REDHAT-BUG-887962?
Versions of Squid prior to 3.1 and 3.2 are affected by REDHAT-BUG-887962.
Can REDHAT-BUG-887962 be exploited remotely?
Yes, REDHAT-BUG-887962 can be exploited remotely, allowing attackers to send crafted requests to the Squid server.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-5643
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/squid
- canonical/squid web proxy cache