Detections
Analytics
Squid 3.x < 3.2.9 / 3.3.x < 3.3.3 DoS
high Nessus Network Monitor Plugin ID 8635
Synopsis
The remote proxy server is affected by two denial of service vulnerabilities.Description
Squid versions 3.2.x prior to 3.2.9, and 3.3.x prior to 3.3.3 are affected by two denial of service vulnerabilities. These vulnerabilities exist due to an error in processing the HTTP header values and due to a miscalculation of memory size when handling HTTP header values. Specifically, these issues affect the 'httpMakeVaryMark()' function of the 'src/http.cc' source file. Attackers can exploit this issue to terminate the main process of squid (parent), resulting in denial of service conditions.Solution
Either upgrade to Squid version 3.2.9, 3.3.3 or later, or apply the vendor-supplied patch.See Also
Plugin Details
Severity: High
ID: 8635
Family: Web Servers
Published: 5/21/2015
Updated: 3/6/2019
Risk Information
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:squid-cache:squid
Patch Publication Date: 3/14/2013
Vulnerability Publication Date: 3/5/2013