Squid < 3.0.STABLE24 HTCP Request DoS

medium Nessus Network Monitor Plugin ID 5340

Synopsis

The remote proxy server is vulnerable to a Denial of Service (DoS) attack.

Description

According to its banner, the version of Squid proxy caching server installed on the remote host is 2.x or 3.0.x earlier than 3.0.STABLE24. Such versions are potentially affected by a denial-of-service vulnerability due to incorrect processing of specially crafted HTCP packets.

Solution

Either upgrade to Squid version 3.0.STABLE24 or later, or apply the patch referenced in the project's advisory above.

Plugin Details

Severity: Medium

ID: 5340

Family: Web Servers

Published: 2/12/2010

Updated: 3/6/2019

Nessus ID: 45591

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:squid-cache:squid

Patch Publication Date: 2/12/2010

Vulnerability Publication Date: 2/12/2010

Reference Information

CVE: CVE-2010-0639

BID: 38212

Detections

Analytics