CVE-2005-0241
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 69.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 69.66% probability · 99th percentile
- CISA KEV
- Not listed
- Affected
- squid/squid
- Source
- security@debian.org
References
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000931Patch
- http://fedoranews.org/updates/FEDORA--.shtml
- http://secunia.com/advisories/14091
- http://www.kb.cert.org/vuls/id/823350Patch, Third Party Advisory, US Government Resource
- http://www.novell.com/linux/security/advisories/2005_06_squid.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-060.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-061.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/12412
- http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-oversize_reply_headersPatch
- http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patchPatch
- http://www.squid-cache.org/bugs/show_bug.cgi?id=1216Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19060
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10998
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000931Patch
- http://fedoranews.org/updates/FEDORA--.shtml
- http://secunia.com/advisories/14091
- http://www.kb.cert.org/vuls/id/823350Patch, Third Party Advisory, US Government Resource
- http://www.novell.com/linux/security/advisories/2005_06_squid.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-060.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-061.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/12412
- http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-oversize_reply_headersPatch
- http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patchPatch
- http://www.squid-cache.org/bugs/show_bug.cgi?id=1216Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19060
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10998
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.