The htcpHandleTstRequest function in htcp.c in Squid 2.x before 2.6.STABLE24 and 2.7 before 2.7.STABLE8, and htcp.cc in 3.0 before 3.0.STABLE24, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets to the HTCP port.

This update fixes the following security issues :

  - 587375: NULL deref via HTCP request (CVE-2010-0639)

This update fixes the following security issue :

  - 587375: squid NULL deref via HTCP request     (CVE-2010-0639)

The remote host is affected by the vulnerability described in GLSA-201110-24 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote unauthenticated attackers may be able to execute arbitrary code       with the privileges of the Squid process or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Denial of service issue in HTCP processing (SQUID-2010:2) http://www.squid- cache.org/Advisories/SQUID-2010_2.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of the Squid proxy caching server installed on the remote host is older than 3.0.STABLE24 / 2.7.STABLE8 / 2.6.STABLE24. Such versions de-reference a NULL pointer while handling certain Hypertext Caching Protocol (HTCP) requests.

This mishandling can be abused by a remote attacker to cause a denial of service by sending specially crafted HTCP requests to an affected service.

Note that Nessus has relied only on the version in the proxy server's banner, which is not updated by either of the patches the project has released to address this issue. If one of those has been applied properly and the service restarted, consider this to be a false positive.

A vulnerability has been found and corrected in squid :

The htcpHandleTstRequest function in htcp.c in Squid 2.x and 3.0 through 3.0.STABLE23 allows remote attackers to cause a denial of service (crash) via crafted packets to the HTCP port, which triggers a NULL pointer dereference (CVE-2010-0639).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

The updated packages have been patched to correct this issue.

It was discovered that Squid incorrectly handled certain malformed packets received on the HTCP port. A remote attacker could exploit this with a specially crafted packet and cause Squid to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Squid security advisory 2010:2 reports :

Due to incorrect processing Squid is vulnerable to a denial of service attack when receiving specially crafted HTCP packets.

This problem allows any machine to perform a denial of service attack on the Squid service when its HTCP port is open.

According to its banner, the version of Squid proxy caching server installed on the remote host is 2.x or 3.0.x earlier than 3.0.STABLE24.  Such versions are potentially affected by a denial-of-service vulnerability due to incorrect processing of specially crafted HTCP packets.

ID	Name	Product	Family	Severity
76029	openSUSE Security Update : squid (openSUSE-SU-2012:0102-1)	Nessus	SuSE Local Security Checks	medium
75745	openSUSE Security Update : squid (openSUSE-SU-2012:0102-1)	Nessus	SuSE Local Security Checks	medium
57726	SuSE 11.1 Security Update : squid (SAT Patch Number 5584)	Nessus	SuSE Local Security Checks	medium
56658	GLSA-201110-24 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
47299	Fedora 12 : squid-3.1.0.16-6.fc12 (2010-3064)	Nessus	Fedora Local Security Checks	medium
47291	Fedora 11 : squid-3.0.STABLE24-1.fc11 (2010-2434)	Nessus	Fedora Local Security Checks	medium
45591	Squid < 3.0.STABLE24 / 2.7.STABLE8 / 2.6.STABLE24	Nessus	Firewalls	medium
45031	Mandriva Linux Security Advisory : squid (MDVSA-2010:060)	Nessus	Mandriva Local Security Checks	medium
44913	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : squid vulnerability (USN-904-1)	Nessus	Ubuntu Local Security Checks	medium
44601	FreeBSD : squid -- Denial of Service vulnerability in HTCP (81d9dc0c-1988-11df-8e66-0019996bc1f7)	Nessus	FreeBSD Local Security Checks	medium
801037	Squid < 3.0STABLE24 HTCP Request Denial of Service	Log Correlation Engine	Web Servers	medium
5340	Squid < 3.0.STABLE24 HTCP Request DoS	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2010-0639

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium