Mandrake Linux Security Advisory : squid (MDKSA-2005:014)

'infamous41md' discovered two vulnerabilities in the squid proxy cache server. The first is a buffer overflow in the Gopher response parser which leads to memory corruption and would usually crash squid CVE-2005-0094. The second is an integer overflow in the receiver of WCCP Web Cache Communicati...

squid -- possible cache-poisoning via malformed HTTP responses

The squid patches page notes: This patch makes Squid considerably stricter while parsing the HTTP protocol. A Content-length header should only appear once in a valid request or response. Multiple Content-length headers, in conjunction with specially crafted requests, may allow Squid's cache to b...

USN-67-1: Squid vulnerabilities

infamous41md discovered several Denial of Service vulnerabilities in squid. A malicious Gopher server could crash squid by sending a line bigger than 4096 bytes. CAN-2005-0094 If squid is configured to send WCPP Web Cache Communication Protocol messages to a "home router", an attacker who was abl...

Squid < 2.5.STABLE8 DoS

Binary data 2520.prm...

[SECURITY] [DSA 651-1] New squid packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 651-1 [email protected] http://www.debian.org/security/ Martin Schulze January 20th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 651-1] New squid packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 651-1 [email protected] http://www.debian.org/security/ Martin Schulze January 20th, 2005 http://www.debian.org/security/faq -...

[SA13843] Squid Username Whitespace Security Bypass Issue

TITLE: Squid Username Whitespace Security Bypass Issue SECUNIA ADVISORY ID: SA13843 VERIFY ADVISORY: http://secunia.com/advisories/13843/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: From local network SOFTWARE: Squid 2.x http://secunia.com/product/310/ DESCRIPTION: A security issue has...

DSA-651-1 squid - buffer overflow, integer overflow

Bulletin has no description...

squid proxy server access control lists protection bypass

If LDAP authentication is used space can be added to username to bypass ACL restrictuions...

CVE-2005-0095

The WCCP message parsing code in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service crash via malformed WCCP messages with source addresses that are spoofed to reference Squid's home router and invalid WCCPISEEYOU cache numbers...

CVE-2005-0094

CVE-2005-0094 affects Squid’s Gopher reply parser (gopherToHTML) and causes a buffer overflow that can allow remote Gopher servers to crash the daemon (DoS) via a crafted response. The original entry specifies Squid 2.5.STABLE7 and earlier as vulnerable. Several connected advisories map this issu...

CVE-2005-0095

The WCCP message parsing code in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service crash via malformed WCCP messages with source addresses that are spoofed to reference Squid's home router and invalid WCCPISEEYOU cache numbers...

CVE-2005-0097

The NTLM component in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service crash via a malformed NTLM type 3 message that triggers a NULL dereference...

CVE-2005-0095

CVE-2005-0095 affects Squid 2.5.STABLE7 and earlier. The vulnerability arises in the Web Cache Communication Protocol (WCCP) message parsing: an attacker can send a malformed WCCP I_SEE_YOU message with a spoofed source address pointing to Squid’s home router and an invalid WCCP_I_SEE_YOU cache n...

CVE-2005-0096

Memory leak in the NTLM fakeauthauth helper for Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service memory consumption...

CVE-2005-0097

The NTLM component in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service crash via a malformed NTLM type 3 message that triggers a NULL dereference...

CVE-2005-0096

CVE-2005-0096 affects Squid 2.5.STABLE7 and earlier, where a memory leak in the NTLM fakeauth_auth helper can cause a denial of service through unbounded memory growth. The vulnerability is triggered remotely via the network. Connected advisories/entries show remediation efforts for Squid (e.g., ...

CVE-2005-0096

Memory leak in the NTLM fakeauthauth helper for Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service memory consumption...

CVE-2005-0097

CVE-2005-0097 affects the NTLM component in Squid 2.5.STABLE7 and earlier, enabling a remote denial-of-service crash via a malformed NTLM type 3 message that triggers a NULL dereference. The connected records corroborate impact across multiple vendors/distros (e.g., Red Hat RHSA-2005:060/061, Gen...

CVE-2005-0094

Buffer overflow in the gopherToHTML function in the Gopher reply parser for Squid 2.5.STABLE7 and earlier allows remote malicious Gopher servers to cause a denial of service crash via crafted responses...