fkie_cve-2009-2621
Vulnerability from fkie_nvd
Published
2009-07-28 17:30
Modified
2024-11-21 01:05
Severity ?
Summary
Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 does not properly enforce "buffer limits and related bound checks," which allows remote attackers to cause a denial of service via (1) an incomplete request or (2) a request with a large header size, related to (a) HttpMsg.cc and (b) client_side.cc.
References
cret@cert.orghttp://secunia.com/advisories/36007
cret@cert.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2009:161
cret@cert.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2009:178
cret@cert.orghttp://www.securityfocus.com/bid/35812
cret@cert.orghttp://www.securitytracker.com/id?1022607
cret@cert.orghttp://www.squid-cache.org/Advisories/SQUID-2009_2.txtVendor Advisory
cret@cert.orghttp://www.squid-cache.org/Versions/v3/3.1/changesets/b9654.patchPatch
cret@cert.orghttp://www.vupen.com/english/advisories/2009/2013
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36007
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2009:161
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2009:178
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/35812
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1022607
af854a3a-2127-422b-91ae-364da2661108http://www.squid-cache.org/Advisories/SQUID-2009_2.txtVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.squid-cache.org/Versions/v3/3.1/changesets/b9654.patchPatch
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/2013
Impacted products
Vendor Product Version
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.0
squid-cache squid 3.1
squid-cache squid 3.1.0.1
squid-cache squid 3.1.0.2
squid-cache squid 3.1.0.3
squid-cache squid 3.1.0.4


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:pre1:*:*:*:*:*",
                     matchCriteriaId: "CF9C0078-D06B-4174-AF2C-599638E5B29D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:pre2:*:*:*:*:*",
                     matchCriteriaId: "F1DD47BA-EA59-4DCC-BFF3-2DF0BC332CBB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:pre3:*:*:*:*:*",
                     matchCriteriaId: "2BC1746D-BE02-4D04-B31D-95589EBD4C93",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:pre4:*:*:*:*:*",
                     matchCriteriaId: "62C35710-215C-4B80-9304-665451F3C0AB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:pre5:*:*:*:*:*",
                     matchCriteriaId: "76A7416C-64B2-4F52-93FD-9C504B7D4F40",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:pre6:*:*:*:*:*",
                     matchCriteriaId: "17D51261-2071-4E8F-AD75-2ECCBE7F7C04",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:pre7:*:*:*:*:*",
                     matchCriteriaId: "ACD9E084-007E-4C6A-8D30-2DC9B355D7B5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable1:*:*:*:*:*",
                     matchCriteriaId: "95912E0D-FACF-459B-94FB-334FDBCC292B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable10:*:*:*:*:*",
                     matchCriteriaId: "2C455506-7FBF-4F0E-92E7-F074B74C10D7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable11:*:*:*:*:*",
                     matchCriteriaId: "67288E3E-88BF-44CE-84EF-1BF98E8C38CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable12:*:*:*:*:*",
                     matchCriteriaId: "B428BDA9-8C83-4DE3-9391-17AFD5D750BB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable13:*:*:*:*:*",
                     matchCriteriaId: "DC57EAB8-BFEF-4FE2-8ADB-D196EAE3E51D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable14:*:*:*:*:*",
                     matchCriteriaId: "935F2BDE-7F76-4E13-8318-37CE97B7948F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable15:*:*:*:*:*",
                     matchCriteriaId: "354599A2-5FCF-4F5A-85AE-00505D32B9BF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable2:*:*:*:*:*",
                     matchCriteriaId: "1F1BC7B9-9CD1-42E9-84BB-BEE3668BAAA6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable3:*:*:*:*:*",
                     matchCriteriaId: "88E3716B-863A-40D4-A7D9-F2A288B87394",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable4:*:*:*:*:*",
                     matchCriteriaId: "02FB3C5B-95F1-4839-8F68-649AFA2FEB1C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable5:*:*:*:*:*",
                     matchCriteriaId: "631CBA69-B2A1-4522-A330-6A87CCBC682C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable6:*:*:*:*:*",
                     matchCriteriaId: "0FE7885D-D1EB-4543-B342-80BC645EE8EC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable7:*:*:*:*:*",
                     matchCriteriaId: "B7C4AE0E-9608-4D24-8EA3-0F33A5D95A5E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable8:*:*:*:*:*",
                     matchCriteriaId: "628344A8-42AE-4AD7-89A2-66711490AB30",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:stable9:*:*:*:*:*",
                     matchCriteriaId: "3260A290-9F63-4E5C-BEF2-015E9491AD18",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:rc1:stable11:*:*:*:*:*",
                     matchCriteriaId: "4F830353-C4E4-4DAF-B7ED-1B0BAE9F3253",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.0:rc4:*:*:*:*:*:*",
                     matchCriteriaId: "131C4C00-3811-42BF-A84A-EB2E5DA156B4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "6A8586AD-E820-4BAE-AAF9-AC7EF2316C06",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "802E3D2B-90B7-4725-854F-4174116BC314",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "7501697A-BCFD-4DC3-8D87-CC9A186D9589",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "0D6C4455-85F4-462D-9FF6-F830ED7D398E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "B600BF4C-8169-4086-BFE6-F066BE5F5406",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 does not properly enforce \"buffer limits and related bound checks,\" which allows remote attackers to cause a denial of service via (1) an incomplete request or (2) a request with a large header size, related to (a) HttpMsg.cc and (b) client_side.cc.",
      },
      {
         lang: "es",
         value: "Squid desde v3.0 hasta v3.0.STABLE16 desde v3.1 hasta v3.1.0.11 no cumple adecuadamente con \"los limites de búfer y comprobaciones vinculadas,\" lo que permite a atacantes remotos producir una denegación de servicio a través de (1) una petición incompleta o (2) una petición con un tamaño largo de cabecera, relacionado con (a) HttpMsg.cc y (b) client_side.cc.",
      },
   ],
   id: "CVE-2009-2621",
   lastModified: "2024-11-21T01:05:18.980",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2009-07-28T17:30:01.077",
   references: [
      {
         source: "cret@cert.org",
         url: "http://secunia.com/advisories/36007",
      },
      {
         source: "cret@cert.org",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2009:161",
      },
      {
         source: "cret@cert.org",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2009:178",
      },
      {
         source: "cret@cert.org",
         url: "http://www.securityfocus.com/bid/35812",
      },
      {
         source: "cret@cert.org",
         url: "http://www.securitytracker.com/id?1022607",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.squid-cache.org/Advisories/SQUID-2009_2.txt",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Patch",
         ],
         url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/b9654.patch",
      },
      {
         source: "cret@cert.org",
         url: "http://www.vupen.com/english/advisories/2009/2013",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/36007",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2009:161",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2009:178",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/35812",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securitytracker.com/id?1022607",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.squid-cache.org/Advisories/SQUID-2009_2.txt",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/b9654.patch",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.vupen.com/english/advisories/2009/2013",
      },
   ],
   sourceIdentifier: "cret@cert.org",
   vendorComments: [
      {
         comment: "Not vulnerable. This issue did not affect the versions of squid as shipped with Red Hat Enterprise Linux 3, 4, or 5.",
         lastModified: "2009-08-06T00:00:00",
         organization: "Red Hat",
      },
   ],
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-119",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.