CVE-2005-0175
published 2005-02-07CVE-2005-0175: Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack.
PriorityP334medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
40.98%
98.5th percentile
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | squid | < squid 2.5.7-6 (bookworm) | squid 2.5.7-6 (bookworm) |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | — | — |
| squid | squid | >= 0 < 2.5.7-6 | 2.5.7-6 |
| squid | squid | >= 0 < 2.5.7-6 | 2.5.7-6 |
| squid | squid | >= 0 < 2.5.7-6 | 2.5.7-6 |
| squid | squid | >= 0 < 2.5.7-6 | 2.5.7-6 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP response splitting attempts targeting Squid cache: look for injected false replies in the HTTP stream from malicious web servers designed to forge cache content for arbitrary web sites ↗
- →Inspect HTTP responses proxied through Squid 2.5 up to 2.5.STABLE7 for cache poisoning indicators such as multiple Content-Length header lines, invalid Carriage Return characters, and HTTP header names containing whitespace ↗
- ·Vulnerability affects Squid versions 2.5 through 2.5.STABLE7 only; upgrading to the fixed package resolves the issue (Debian fix: 2.5.7-6) ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Squid vulnerabilities
vendor_ubuntu·2005-02-08
CVE-2005-0173 Squid vulnerabilities
Title: Squid vulnerabilities
Summary: Squid vulnerabilities
A possible authentication bypass was discovered in the LDAP
authentication backend. LDAP ignores leading and trailing whitespace
in search filters. This could possibly be abused to bypass explicit
access controls or confuse accounting when using several variants of
the login name. (CAN-2005-0173)
Previous Squid versions were not strict enough while parsing HTTP
requests and responses. Various violations of the HTTP protocol, such
as multiple Content-Length header lines, invalid "Carriage Return"
characters, and HTTP header names containing whitespace, led to cache
pollution and could possibly be exploited to deliver wrong content to
clients. (CAN-2005-0174)
Squid was susceptible to a cache poisoning attack called "HTTP
respons
Red Hat
security flaw
vendor_redhat·2005-01-31·CVSS 5.0
CVE-2005-0175 [MEDIUM] security flaw
security flaw
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack.
Debian
CVE-2005-0175: squid - Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an H...
vendor_debian·2005·CVSS 5.0
CVE-2005-0175 [MEDIUM] CVE-2005-0175: squid - Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an H...
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack.
Scope: local
bookworm: resolved (fixed in 2.5.7-6)
bullseye: resolved (fixed in 2.5.7-6)
forky: resolved (fixed in 2.5.7-6)
sid: resolved (fixed in 2.5.7-6)
trixie: resolved (fixed in 2.5.7-6)
GHSA
GHSA-2rv8-xmpq-rpfx: Squid 2
ghsa_unreviewed·2022-05-01
CVE-2005-0175 [MEDIUM] GHSA-2rv8-xmpq-rpfx: Squid 2
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack.
OSV
CVE-2005-0175: Squid 2
osv·2005-02-07·CVSS 5.0
CVE-2005-0175 [MEDIUM] CVE-2005-0175: Squid 2
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack.
No detection rules found.
No public exploits indexed.
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000931http://fedoranews.org/updates/FEDORA--.shtmlhttp://marc.info/?l=bugtraq&m=110780531820947&w=2http://www.debian.org/security/2005/dsa-667http://www.kb.cert.org/vuls/id/625878http://www.mandriva.com/security/advisories?name=MDKSA-2005:034http://www.novell.com/linux/security/advisories/2005_06_squid.htmlhttp://www.redhat.com/archives/fedora-announce-list/2005-May/msg00025.htmlhttp://www.redhat.com/support/errata/RHSA-2005-060.htmlhttp://www.redhat.com/support/errata/RHSA-2005-061.htmlhttp://www.securityfocus.com/bid/12433http://www.squid-cache.org/Advisories/SQUID-2005_5.txthttp://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splittinghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11605http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000931http://fedoranews.org/updates/FEDORA--.shtmlhttp://marc.info/?l=bugtraq&m=110780531820947&w=2http://www.debian.org/security/2005/dsa-667http://www.kb.cert.org/vuls/id/625878http://www.mandriva.com/security/advisories?name=MDKSA-2005:034http://www.novell.com/linux/security/advisories/2005_06_squid.htmlhttp://www.redhat.com/archives/fedora-announce-list/2005-May/msg00025.htmlhttp://www.redhat.com/support/errata/RHSA-2005-060.htmlhttp://www.redhat.com/support/errata/RHSA-2005-061.htmlhttp://www.securityfocus.com/bid/12433http://www.squid-cache.org/Advisories/SQUID-2005_5.txthttp://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splittinghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11605
2005-02-07
Published