Joined: 12 May 2004
|Posted: Tue Mar 24, 2009 10:26 pm Post subject: [ GLSA 200903-38 ] Squid: Multiple Denial of Service vulnera
|Gentoo Linux Security Advisory
Title: Squid: Multiple Denial of Service vulnerabilities (GLSA 200903-38)
Date: March 24, 2009
Bug(s): #216319, #257585
Multiple vulnerabilities have been found in Squid which allow for remote
Denial of Service attacks.
Squid is a full-featured web proxy cache.
Vulnerable: < 2.7.6
Unaffected: >= 2.7.6
Architectures: All supported architectures
- The arrayShrink function in lib/Array.c can cause an array to
shrink to 0 entries, which triggers an assert error. NOTE: this issue
is due to an incorrect fix for CVE-2007-6239 (CVE-2008-1612).
- An invalid version number in a HTTP request may trigger an
assertion in HttpMsg.c and HttpStatusLine.c (CVE-2009-0478).
The issues allows for Denial of Service attacks against the service via
an HTTP request with an invalid version number and other specially
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=net-proxy/squid-2.7.6"
Last edited by GLSA on Mon Jun 10, 2013 4:30 am; edited 1 time in total