5

CVE-2005-0241

The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Squid ≫ Squid Version2.5.stable1
Squid ≫ Squid Version2.5.stable2
Squid ≫ Squid Version2.5.stable3
Squid ≫ Squid Version2.5.stable4
Squid ≫ Squid Version2.5.stable5
Squid ≫ Squid Version2.5.stable6
Squid ≫ Squid Version2.5.stable7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 69.66% 0.993
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://fedoranews.org/updates/FEDORA--.shtml
http://www.novell.com/linux/security/advisories/2005_06_squid.html
Patch
Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-060.html
Patch
Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-061.html
Patch
Vendor Advisory
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000931
Patch
http://www.securityfocus.com/bid/12412
http://secunia.com/advisories/14091
http://www.kb.cert.org/vuls/id/823350
Patch
Third Party Advisory
US Government Resource
http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-oversize_reply_headers
Patch
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch
Patch
http://www.squid-cache.org/bugs/show_bug.cgi?id=1216
Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/19060
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10998