Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0801 to the following vulnerability:

Name: CVE-2009-0801 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0801 Assigned: 20090304 Reference: CERT-VN:VU#435052 Reference: URL: http://www.kb.cert.org/vuls/id/435052 Reference: BID:33858 Reference: URL: http://www.securityfocus.com/bid/33858

Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.

Squid security advisory SQUID-2007:2 was published recently:

http://www.squid-cache.org/Advisories/SQUID-20072.txt

Problem Description:

Due to incorrect bounds checking Squid is vulnerable to a denial of service check during some cache update reply processing.

Severity:

This problem allows any client trusted to use the service to perform a denial of service attack on the Squid service.