ZeroBox Vulnerability Database

漏洞起因
设计错误
 
影响系统
Squid Web Proxy Cache 3.1 5
Squid Web Proxy Cache 3.1 4
Squid Web Proxy Cache 3.0
Squid Web Proxy Cache 3.1.0.11
Squid Web Proxy Cache 3.1
Squid Web Proxy Cache 3.0.STABLE7
Squid Web Proxy Cache 3.0.STABLE6
Squid Web Proxy Cache 3.0.STABLE5
Squid Web Proxy Cache 3.0.STABLE4
Squid Web Proxy Cache 3.0.STABLE3
Squid Web Proxy Cache 3.0.STABLE2
Squid Web Proxy Cache 3.0.STABLE16
Squid Web Proxy Cache 3.0.STABLE13
Squid Web Proxy Cache 3.0.STABLE12
Squid Web Proxy Cache 3.0.STABLE1
 
不受影响系统
Squid Web Proxy Cache 3.1.0.12
Squid Web Proxy Cache 3.0.STABLE17
 
危害
远程攻击者可以利用漏洞使应用程序崩溃。
 
攻击所需条件
攻击者必须访问Squid。
 
漏洞信息
Squid是一款功能强大的代理服务器和Web缓存服务器。
Squid存在安全问题，远程攻击者可以利用漏洞使应用程序崩溃。
-当处理特殊构建的请求或应答时不正确的缓冲区限制和相关的边界检查，可导致拒绝服务攻击。
-当处理特殊构建的应答时不正确的数据验证，可导致拒绝服务攻击。
 
测试方法
 
厂商解决方案
用户可参考如下补丁：
Squid Web Proxy Cache 3.0.STABLE2
Squid b9070.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9070.patch
Squid b9074.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9074.patch
Squid b9075.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9075.patch
Squid Web Proxy Cache 3.0.STABLE7
Squid b9070.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9070.patch
Squid b9074.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9074.patch
Squid b9075.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9075.patch
Squid Web Proxy Cache 3.0.STABLE6
Squid b9070.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9070.patch
Squid b9074.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9074.patch
Squid b9075.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9075.patch
Squid Web Proxy Cache 3.0.STABLE1
Squid b9070.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9070.patch
Squid b9074.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9074.patch
Squid b9075.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9075.patch
Squid Web Proxy Cache 3.0.STABLE3
Squid b9070.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9070.patch
Squid b9074.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9074.patch
Squid b9075.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9075.patch
Squid Web Proxy Cache 3.1
Squid b9654.patch
http://www.squid-cache.org/Versions/v3/3.1/changesets/b9654.patch
Squid b9661.patch
http://www.squid-cache.org/Versions/v3/3.1/changesets/b9661.patch
Squid Web Proxy Cache 3.0.STABLE12
Squid b9070.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9070.patch
Squid b9074.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9074.patch
Squid b9075.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9075.patch
Squid Web Proxy Cache 3.0.STABLE4
Squid b9070.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9070.patch
Squid b9074.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9074.patch
Squid b9075.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9075.patch
Squid Web Proxy Cache 3.0.STABLE13
Squid b9070.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9070.patch
Squid b9074.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9074.patch
Squid b9075.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9075.patch
Squid Web Proxy Cache 3.1.0.11
Squid b9654.patch
http://www.squid-cache.org/Versions/v3/3.1/changesets/b9654.patch
Squid b9661.patch
http://www.squid-cache.org/Versions/v3/3.1/changesets/b9661.patch
Squid Web Proxy Cache 3.0.STABLE16
Squid b9070.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9070.patch
Squid b9074.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9074.patch
Squid b9075.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9075.patch
Squid Web Proxy Cache 3.0.STABLE5
Squid b9070.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9070.patch
Squid b9074.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9074.patch
Squid b9075.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9075.patch
Squid Web Proxy Cache 3.0
Squid b9070.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9070.patch
Squid b9074.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9074.patch
Squid b9075.patch
http://www.squid-cache.org/Versions/v3/3.0/changesets/b9075.patch
Squid Web Proxy Cache 3.1 4
Squid b9654.patch
http://www.squid-cache.org/Versions/v3/3.1/changesets/b9654.patch
Squid b9661.patch
http://www.squid-cache.org/Versions/v3/3.1/changesets/b9661.patch
Squid Web Proxy Cache 3.1 5
Squid b9654.patch
http://www.squid-cache.org/Versions/v3/3.1/changesets/b9654.patch
Squid b9661.patch
http://www.squid-cache.org/Versions/v3/3.1/changesets/b9661.patch
 
漏洞提供者
Alex Montoanelli of www.unetvale.net, Rob Middleton of Centenary Institute, Tuomo Untinen, Ossi Herrala, and Jukka Taimisto from the CROSS project at Codenomicon Ltd.