Gentoo Logo

Squid: Multiple Denial of Service vulnerabilities

Content:

1.  Gentoo Linux Security Advisory

Version Information

Advisory Reference GLSA 200701-22 / squid
Release Date January 25, 2007
Latest Revision January 25, 2007: 01
Impact normal
Exploitable remote
Package Vulnerable versions Unaffected versions Architecture(s)
net-proxy/squid < 2.6.7 >= 2.6.7 All supported architectures

Related bugreports: #162364

Synopsis

Two vulnerabilities have been found in Squid which make it susceptible to Denial of Service attacks.

2.  Impact Information

Background

Squid is a multi-protocol proxy server.

Description

Squid fails to correctly handle ftp:// URI's. There is also an error in the external_acl queue which can cause an infinite looping condition.

Impact

An attacker could attempt to retrieve a specially crafted URI via a Squid server causing the service to crash. If an attacker could generate a sufficiently high load on the Squid services, they could cause a Denial of Service by forcing Squid into an infinite loop.

3.  Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Squid users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-proxy/squid-2.6.7"

4.  References



Print

Page updated January 25, 2007

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.

Copyright 2001-2014 Gentoo Foundation, Inc. Questions, Comments? Contact us.