CVE-2005-0095 — Squid vulnerability

8 documents7 sources

Severity

5.0MEDIUMNVD

EPSS

75.8%

top 1.09%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Squid Debian Squid

Timeline

PublishedJan 15

Latest updateMay 1

Description

The WCCP message parsing code in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via malformed WCCP messages with source addresses that are spoofed to reference Squid's home router and invalid WCCP_I_SEE_YOU cache numbers.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/squid< squid 2.5.7-4 (bookworm)

▶Debiansquid/squid< 2.5.7-4+3

▶NVDsquid/squid27 versions+26

Patches

Patch: distro.conectiva.com.br ↗Patch: secunia.com ↗Patch: security.gentoo.org ↗

🔴Vulnerability Details

GHSA

GHSA-f5hx-2mw6-fpj8: The WCCP message parsing code in Squid 2↗2022-05-01

▶

OSV

CVE-2005-0095: The WCCP message parsing code in Squid 2↗2005-01-15

▶

📋Vendor Advisories

Ubuntu

Squid vulnerabilities↗2005-01-21

▶

Red Hat

security flaw↗2005-01-12

▶

Debian

CVE-2005-0095: squid - The WCCP message parsing code in Squid 2.5.STABLE7 and earlier allows remote att...↗2005

▶

💬Community

Bugzilla

CVE-2005-0095 security flaw↗2018-08-16

▶

Bugzilla

Squid Multiple Vulnerabilities (CVE-2004-0541 CVE-2004-0832 CVE-2004-0918 CVE-2005-0094 CVE-2005-0095 CVE-2005-0096 CVE-2005-0097 CVE-2005-0446 CVE-2005-0626 CVE-2005-0718 CVE-1999-0710 CVE-2005-1345↗2004-10-11

▶