Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Squid 3.x < 3.2.9 / 3.3.x < 3.3.3 DoS

High

Synopsis

The remote proxy server is affected by two denial of service vulnerabilities.

Description

Squid versions 3.2.x prior to 3.2.9, and 3.3.x prior to 3.3.3 are affected by two denial of service vulnerabilities. These vulnerabilities exist due to an error in processing the HTTP header values and due to a miscalculation of memory size when handling HTTP header values. Specifically, these issues affect the 'httpMakeVaryMark()' function of the 'src/http.cc' source file. Attackers can exploit this issue to terminate the main process of squid (parent), resulting in denial of service conditions.

Solution

Either upgrade to Squid version 3.2.9, 3.3.3 or later, or apply the vendor-supplied patch.