Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c.

A Denial of service condition in HTTP-request processing was fixed in squid. CVE-2009-0478 has been assigned to this issue.

Due to an internal error Squid is vulnerable to a denial of service attack when processing specially crafted requests. This problem allows any client to perform a denial of service attack on the Squid service (CVE-2009-0478).

The updated packages have been patched to adress this.

Joshua Morin, Mikko Varpiola and Jukka Taimisto discovered that Squid did not properly validate the HTTP version when processing requests. A remote attacker could exploit this to cause a denial of service (assertion failure).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Feb 5 2009 Jonathan Steffan <jsteffan at     fedoraproject.org> - 7:3.0.STABLE13-1

    - upgrade to latest upstream

    - Thu Jan 29 2009 Henrik Nordstrom <henrik at       henriknordstrom.net> - 7:3.0.STABLE12-1

    - upgrade to latest upstream

    - Fri Dec 19 2008 Henrik Nordstrom <henrik at       henriknordstrom.net> - 7:3.0.STABLE10-3

    - actually include the upstream bugfixes in the build

    - Fri Dec 19 2008 Henrik Nordstrom <henrik at       henriknordstrom.net> - 7:3.0.STABLE10-2

    - upstream bugfixes for cache corruption and access.log       response size errors

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200903-38 (Squid: Multiple Denial of Service vulnerabilities)

    The arrayShrink function in lib/Array.c can cause an array to     shrink to 0 entries, which triggers an assert error. NOTE: this issue     is due to an incorrect fix for CVE-2007-6239 (CVE-2008-1612).
    An invalid version number in a HTTP request may trigger an     assertion in HttpMsg.c and HttpStatusLine.c (CVE-2009-0478).
  Impact :

    The issues allows for Denial of Service attacks against the service via     an HTTP request with an invalid version number and other specially     crafted requests.
  Workaround :

    There is no known workaround at this time.

Joshua Morin, Mikko Varpiola and Jukka Taimisto discovered an assertion error in squid3, a full featured Web Proxy cache, which could lead to a denial of service attack.

- Thu Feb 5 2009 Jonathan Steffan <jsteffan at     fedoraproject.org> - 7:3.0.STABLE13-1

    - upgrade to latest upstream

    - Thu Jan 29 2009 Henrik Nordstrom <henrik at       henriknordstrom.net> - 7:3.0.STABLE12-1

    - upgrade to latest upstream

    - Fri Dec 19 2008 Henrik Nordstrom <henrik at       henriknordstrom.net> - 7:3.0.STABLE10-3

    - actually include the upstream bugfixes in the build

    - Fri Dec 19 2008 Henrik Nordstrom <henrik at       henriknordstrom.net> - 7:3.0.STABLE10-2

    - upstream bugfixes for cache corruption and access.log       response size errors

    - Fri Oct 24 2008 Henrik Nordstrom <henrik at       henriknordstrom.net> - 7:3.0.STABLE10-1

    - upgrade to latest upstream

    - change logrotate to move instead of copytruncate

    - disable coss support, not officially supported in 3.0

    - Fri Oct 3 2008 Jiri Skala <jskala at redhat.com> -       7:3.0.STABLE7-2

    - Resolves: #463129 - optional config file

    - Resolves: #458593 - noisy init script

    - Resolves: #450352 - build.patch patches only generated       files

    - Mon Jun 30 2008 Jiri Skala <jskala at redhat.com> -       7:3.0.STABLE7-1

    - upgrade to latest upstream

    - fix CVE-2004-0918 Squid SNMP DoS [Fedora 9] (#453214)

    - Mon May 26 2008 Martin Nagy <mnagy at redhat.com> -       7:3.0.STABLE6-1

    - upgrade to latest upstream

    - fix bad allocation (#447045)

    - Fri May 9 2008 Alexandre Oliva <aoliva at redhat.com>
      - 7:3.0.STABLE2-3

    - fix configure detection of netfilter kernel headers       (#435499)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of the Squid proxy caching server installed on the remote host may abort when parsing requests with an invalid HTTP version.  A remote attacker may be able to leverage this issue to crash the application, thereby denying service to legitimate users.

Note that successful exploitation of this issue requires that Squid was not built with the 'NODEBUG' define.

Squid security advisory 2009:1 reports :

Due to an internal error Squid is vulnerable to a denial of service attack when processing specially crafted requests.

This problem allows any client to perform a denial of service attack on the Squid service.

The version of the Squid proxy caching server installed on the remote host may abort when parsing requests with an invalid HTTP version. A remote attacker may be able to leverage this issue to crash the application, thereby denying service to legitimate users. 

Note that successful exploitation of this issue requires that Squid was not built with the 'NODEBUG' define.

ID	Name	Product	Family	Severity
40310	openSUSE Security Update : squid (squid-535)	Nessus	SuSE Local Security Checks	medium
37418	Mandriva Linux Security Advisory : squid (MDVSA-2009:034)	Nessus	Mandriva Local Security Checks	medium
36786	Ubuntu 8.10 : squid vulnerability (USN-724-1)	Nessus	Ubuntu Local Security Checks	medium
36702	Fedora 10 : squid-3.0.STABLE13-1.fc10 (2009-1526)	Nessus	Fedora Local Security Checks	medium
36013	GLSA-200903-38 : Squid: Multiple Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	medium
35763	Debian DSA-1732-1 : squid3 - denial of service	Nessus	Debian Local Security Checks	medium
35667	Fedora 9 : squid-3.0.STABLE13-1.fc9 (2009-1517)	Nessus	Fedora Local Security Checks	medium
4923	Squid < 2.7.STABLE6 / 3.x < 3.0.STABLE13 / 3.1.x < 3.1.0.5 DoS	Nessus Network Monitor	Web Servers	medium
35626	FreeBSD : squid -- remote denial of service vulnerability (9c2460a4-f6b1-11dd-94d9-0030843d3802)	Nessus	FreeBSD Local Security Checks	medium
35620	Squid < 2.7.STABLE6 / 3.0.STABLE13 / 3.1.0.5 HTTP Version Number Request Remote DoS	Nessus	Firewalls	medium
801049	Squid < 2.7.STABLE6 / 3.0.STABLE13 / 3.1.0.5 HTTP Version Numbers DoS	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2009-0478

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium