The clientProcessRequest() function in src/client_side.c in Squid 2.6 before 2.6.STABLE12 allows remote attackers to cause a denial of service (daemon crash) via crafted TRACE requests that trigger an assertion error.

From Red Hat Security Advisory 2007:0131 :

An updated squid package that fixes a security vulnerability is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects.

A denial of service flaw was found in the way Squid processed the TRACE request method. It was possible for an attacker behind the Squid proxy to issue a malformed TRACE request, crashing the Squid daemon child process. As long as these requests were sent, it would prevent legitimate usage of the proxy server. (CVE-2007-1560)

This flaw does not affect the version of Squid shipped in Red Hat Enterprise Linux 2.1, 3, or 4.

Users of Squid should upgrade to this updated package, which contains a backported patch and is not vulnerable to this issue.

A flaw was discovered in Squid's handling of the TRACE request method which could lead to a crash. Remote attackers with access to the Squid server could send malicious TRACE requests, and cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a remote denial of service problem in Squid 2.6 (CVE-2007-1560).

Other Squid versions are not affected.

An updated squid package that fixes a security vulnerability is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects.

A denial of service flaw was found in the way Squid processed the TRACE request method. It was possible for an attacker behind the Squid proxy to issue a malformed TRACE request, crashing the Squid daemon child process. As long as these requests were sent, it would prevent legitimate usage of the proxy server. (CVE-2007-1560)

This flaw does not affect the version of Squid shipped in Red Hat Enterprise Linux 2.1, 3, or 4.

Users of Squid should upgrade to this updated package, which contains a backported patch and is not vulnerable to this issue.

The remote host is affected by the vulnerability described in GLSA-200703-27 (Squid: Denial of Service)

    Squid incorrectly handles TRACE requests that contain a 'Max-Forwards'     header field with value '0' in the clientProcessRequest() function.
  Impact :

    A remote attacker can send specially crafted TRACE HTTP requests that     will terminate the child process. A quickly repeated attack will lead     to a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Due to an internal error Squid-2.6 is vulnerable to a denial of service attack when processing the TRACE request method. This problem allows any client trusted to use the service to perform a denial of service attack on the Squid service.

Updated packages have been patched to address this issue.

Squid advisory 2007:1 notes :

Due to an internal error Squid-2.6 is vulnerable to a denial of service attack when processing the TRACE request method.

Workarounds :

To work around the problem deny access to using the TRACE method by inserting the following two lines before your first http_access rule.

acl TRACE method TRACE

http_access deny TRACE

A vulnerability in TRACE request processing has been reported in Squid, which can be exploited by malicious people to cause a denial of service.

A vulnerability in TRACE request processing has been reported in Squid that can be exploited by remote attackers to cause a denial of service.

A vulnerability in TRACE request processing has been reported in Squid that can be exploited by malicious people to cause a denial of service.

ID	Name	Product	Family	Severity
67467	Oracle Linux 5 : squid (ELSA-2007-0131)	Nessus	Oracle Linux Local Security Checks	medium
28038	Ubuntu 6.10 : squid vulnerability (USN-441-1)	Nessus	Ubuntu Local Security Checks	medium
27453	openSUSE 10 Security Update : squid (squid-3036)	Nessus	SuSE Local Security Checks	medium
25323	RHEL 5 : squid (RHSA-2007:0131)	Nessus	Red Hat Local Security Checks	medium
24932	GLSA-200703-27 : Squid: Denial of Service	Nessus	Gentoo Local Security Checks	medium
24894	Mandrake Linux Security Advisory : squid (MDKSA-2007:068)	Nessus	Mandriva Local Security Checks	medium
24886	FreeBSD : Squid -- TRACE method handling denial of service (c27bc173-d7aa-11db-b141-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	medium
24873	Squid < 2.6.STABLE12 src/client_side.c clientProcessRequest() function TRACE Request DoS	Nessus	Firewalls	medium
3952	Squid < 2.6 STABLE12 TRACE Request DoS	Nessus Network Monitor	Web Servers	medium
801033	Squid < 2.6 STABLE12 TRACE Request DoS	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2007-1560

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium