Squid NTLM Authentication NTLMSSP Packet Remote DoS

Medium Log Correlation Engine Plugin ID 801032

Synopsis

The remote host is vulnerable to a Denial of Service (DoS) attack.

Description

The remote server is running a Squid proxy server. This version is reported vulnerable to a remote denial of service in the NTLM authentication routine. If NTLM authentication is enabled, an attacker may deny service to legitimate users by sending malformed NTLMSSP packets.

Solution

Apply the relevant patch from http://www.squid-cache.org/squid/Versions/v2/2.5/bugs/squid-2.5.STABLE6-ntlm_fetch_string.patch

See Also

http://.squid-cache.org

Plugin Details

Severity: Medium

ID: 801032

File Name: 801032.prm

Family: Web Servers

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:ND

Reference Information

CVE: CVE-2004-0832

BID: 11098