The remote host is affected by the vulnerability described in GLSA-200502-25 (Squid: Denial of Service through DNS responses)

    Handling of certain DNS responses trigger assertion failures.
  Impact :

    By returning a specially crafted DNS response an attacker could     cause Squid to crash by triggering an assertion failure.
  Workaround :

    There is no known workaround at this time.

The squid developers discovered that a remote attacker could cause squid to crash via certain DNS responses.

The updated packages are patched to fix the problem.

Upstream developers have discovered several problems in squid, the Internet object cache, the popular WWW proxy cache. A remote attacker can cause squid to crash via certain DNS responses.

The Squid team reported several denial-of-service vulnerabilities related to the handling of DNS responses and NT Lan Manager messages.
These may allow an attacker to crash the Squid cache.

Updated squid packages that fix a denial of service issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team

Squid is a full-featured Web proxy cache.

A bug was found in the way Squid handles FQDN lookups. It was possible to crash the Squid server by sending a carefully crafted DNS response to an FQDN lookup. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0446 to this issue.

Users of squid should upgrade to this updated package, which contains a backported patch, and is not vulnerable to this issue.

This update fixes CVE-2005-0446 Squid DoS from bad DNS response

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

When parsing the configuration file, squid interpreted empty Access Control Lists (ACLs) without defined authentication schemes in a non-obvious way. This could allow remote attackers to bypass intended ACLs. (CAN-2005-0194)

A remote Denial of Service vulnerability was discovered in the domain name resolution code. A faulty or malicious DNS server could stop the Squid server immediately by sending a malformed IP address.
(CAN-2005-0446).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is missing the patch for the advisory SUSE-SA:2005:008 (squid).


Squid is an Open Source web proxy.

A remote attacker was potentially able to crash the Squid web proxy if the log_fqdn option was set to 'on' and the DNS replies were manipulated.

This is tracked by the Mitre CVE ID CVE-2005-0446.

This update also fixes a defect in the last security update patch (CVE-2005-0241).

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:201 advisory.

    Squid is a full-featured Web proxy cache.

    A bug was found in the way Squid handles fully qualified domain name (FQDN)     lookups.  A malicious DNS server could crash Squid by sending a carefully     crafted DNS response to an FQDN lookup.  The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0446 to     this issue.

    This erratum also includes two minor patches to the LDAP helpers.  One     corrects a slight malformation in ldap search requests (although all     known LDAP servers accept the requests).  The other adds documentation     for the -v option to the ldap helpers.

    Users of Squid should upgrade to this updated package, which contains a     backported patch, and is not vulnerable to this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
17144	GLSA-200502-25 : Squid: Denial of Service through DNS responses	Nessus	Gentoo Local Security Checks	2/18/2005	1/6/2021	medium
17216	Mandrake Linux Security Advisory : squid (MDKSA-2005:047)	Nessus	Mandriva Local Security Checks	2/25/2005	1/6/2021	medium
17196	Debian DSA-688-1 : squid - missing input sanitising	Nessus	Debian Local Security Checks	2/23/2005	1/4/2021	medium
18947	FreeBSD : squid -- denial-of-service vulnerabilities (5bf1a715-cc57-440f-b0a5-6406961c54a7)	Nessus	FreeBSD Local Security Checks	7/13/2005	1/6/2021	medium
17264	RHEL 2.1 / 3 : squid (RHSA-2005:173)	Nessus	Red Hat Local Security Checks	3/4/2005	1/14/2021	medium
19614	Fedora Core 2 : squid-2.5.STABLE8-1.FC2.1 (2005-153)	Nessus	Fedora Local Security Checks	9/12/2005	1/11/2021	medium
20709	Ubuntu 4.10 : squid vulnerabilities (USN-84-1)	Nessus	Ubuntu Local Security Checks	1/15/2006	1/19/2021	critical
19615	Fedora Core 3 : squid-2.5.STABLE8-1.FC3.1 (2005-154)	Nessus	Fedora Local Security Checks	9/12/2005	1/11/2021	medium
17198	SUSE-SA:2005:008: squid	Nessus	SuSE Local Security Checks	2/23/2005	1/14/2021	medium
17340	RHEL 4 : squid (RHSA-2005:201)	Nessus	Red Hat Local Security Checks	3/16/2005	11/4/2024	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

critical

medium

medium

high