The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17 allows attackers to cause a denial of service (process exit) via unknown vectors that cause an array to shrink to 0 entries, which triggers an assert error. NOTE: this issue is due to an incorrect fix for CVE-2007-6239.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2008-0214 advisory.

    - fix for #439801 - regression introduced in fix for CVE-2007-6239

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the way squid manipulated HTTP headers for cached objects stored in system memory. An attacker could use this flaw to cause a squid child process to exit. This interrupted existing connections and made proxy services unavailable. Note: the parent squid process started a new child process, so this attack only resulted in a temporary denial of service. (CVE-2008-1612)

A flaw in a previous previous security update could cause squid to crash under certain circumstances. (CVE-2008-1612)

An incorrect fix for CVE-2007-6239 resulted in Squid not performing proper bounds checking when processing cache update replies. Because of this, a remote authenticated user might have been able to trigger an assertion error and cause a denial of service (CVE-2008-1612).

The updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200903-38 (Squid: Multiple Denial of Service vulnerabilities)

    The arrayShrink function in lib/Array.c can cause an array to     shrink to 0 entries, which triggers an assert error. NOTE: this issue     is due to an incorrect fix for CVE-2007-6239 (CVE-2008-1612).
    An invalid version number in a HTTP request may trigger an     assertion in HttpMsg.c and HttpStatusLine.c (CVE-2009-0478).
  Impact :

    The issues allows for Denial of Service attacks against the service via     an HTTP request with an invalid version number and other specially     crafted requests.
  Workaround :

    There is no known workaround at this time.

A weakness has been discovered in squid, a caching proxy server. The flaw was introduced upstream in response to CVE-2007-6239, and announced by Debian in DSA-1482-1. The flaw involves an over-aggressive bounds check on an array resize, and could be exploited by an authorized client to induce a denial of service condition against squid.

A flaw in a previous previous security update could cause squid to crash under certain circumstances (CVE-2008-1612).

This update fix a regression introduced in Squid security advisory SQUID-2007:2. Attacker could use this flaw to cause exit of squid child process, interrupting proxied connections and causing temporary denial of service. (CVE-2008-1612, #439801)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Squid did not perform proper bounds checking when processing cache update replies. A remote authenticated user may be able to trigger an assertion error and cause a denial of service.
This vulnerability is due to an incorrect upstream fix for CVE-2007-6239. (CVE-2008-1612).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated squid packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects.

A flaw was found in the way squid manipulated HTTP headers for cached objects stored in system memory. An attacker could use this flaw to cause a squid child process to exit. This interrupted existing connections and made proxy services unavailable. Note: the parent squid process started a new child process, so this attack only resulted in a temporary denial of service. (CVE-2008-1612)

Users of squid are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2008:0214 advisory.

    Squid is a high-performance proxy caching server for Web clients,     supporting FTP, gopher, and HTTP data objects.

    A flaw was found in the way squid manipulated HTTP headers for cached     objects stored in system memory. An attacker could use this flaw to cause a     squid child process to exit. This interrupted existing connections and made     proxy services unavailable. Note: the parent squid process started a new     child process, so this attack only resulted in a temporary denial of     service. (CVE-2008-1612)

    Users of squid are advised to upgrade to these updated packages, which     contain a backported patch to resolve this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner, the version of the Squid proxy caching server installed on the remote host is older than 2.6.STABLE18. Such versions reportedly use incorrect bounds checking when processing some cache update replies. A client trusted to use the service may be able to leverage this issue to crash the application, thereby denying service to legitimate users.

Note that an earlier version of the advisory said 2.6.STABLE17 fixed the issue, but it turned out that the patch did not fully address the issue.

According to its banner, the version of the Squid proxy caching server installed on the remote host is older than 2.6.STABLE17.  Such versions reportedly use incorrect bounds checking when processing some cache update replies.  A client trusted to use the service may be able to leverage this issue to crash the application, thereby denying service to legitimate users. 

ID	Name	Product	Family	Severity
67679	Oracle Linux 5 : squid (ELSA-2008-0214)	Nessus	Oracle Linux Local Security Checks	high
60381	Scientific Linux Security Update : squid on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41584	SuSE 10 Security Update : Squid (ZYPP Patch Number 5301)	Nessus	SuSE Local Security Checks	medium
41208	SuSE9 Security Update : squid (YOU Patch Number 12135)	Nessus	SuSE Local Security Checks	medium
36563	Mandriva Linux Security Advisory : squid (MDVSA-2008:134)	Nessus	Mandriva Local Security Checks	medium
36013	GLSA-200903-38 : Squid: Multiple Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	medium
34354	Debian DSA-1646-1 : squid - array bounds check	Nessus	Debian Local Security Checks	medium
32183	SuSE 10 Security Update : squid (ZYPP Patch Number 5157)	Nessus	SuSE Local Security Checks	medium
32182	openSUSE 10 Security Update : squid (squid-5155)	Nessus	SuSE Local Security Checks	medium
32087	Fedora 8 : squid-2.6.STABLE19-1.fc8 (2008-2740)	Nessus	Fedora Local Security Checks	medium
31967	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : squid vulnerability (USN-601-1)	Nessus	Ubuntu Local Security Checks	medium
31947	CentOS 3 / 4 / 5 : squid (CESA-2008:0214)	Nessus	CentOS Local Security Checks	medium
31840	RHEL 4 / 5 : squid (RHSA-2008:0214)	Nessus	Red Hat Local Security Checks	high
29216	Squid < 2.6.STABLE18 Cache Update Reply Unspecified DoS	Nessus	Firewalls	medium
4305	Squid < 2.6.STABLE18 Update Reply Processing DoS	Nessus Network Monitor	Web Servers	medium
801042	Squid < 2.6.STABLE18 Update Reply Processing DoS	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2008-1612

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

high