Detections
Analytics

Squid < 2.4.STABLE4 Buffer Overflow

high Nessus Network Monitor Plugin ID 1523

Synopsis

The remote proxy server is affected by various buffer overflows.

Description

The remote Squid caching proxy, according to its version number, is vulnerable to various buffer overflows. This could allow remote attackers to cause a denial of service (core dump) and possibly execute arbitrary code with an ftp:// URL with a larger number of special characters, which exceed the buffer when Squid URL-escapes the characters.

Solution

Upgrade to Squid 2.4.STABLE4 or higher.

See Also

http://www.squid-cache.org/Advisories/SQUID-2002_1.txt

http://www.squid-cache.org/Versions/v2/2.4/bugs

Plugin Details

Severity: High

ID: 1523

Family: Web Servers

Published: 8/18/2004

Updated: 3/6/2019

Nessus ID: 10923

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:squid-cache:squid

Patch Publication Date: 3/8/2002

Vulnerability Publication Date: 3/8/2002

Reference Information

CVE: CVE-2002-0068

BID: 4148