Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2007-6239

Published: 04/12/2007 Updated: 29/09/2017
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Subscribe to Squid Web Proxy Cache

Vulnerability Summary

The "cache update reply processing" functionality in Squid 2.x prior to 2.6.STABLE17 and Squid 3.0 allows remote malicious users to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.

Vulnerable Product Search on Vulmon Subscribe to Product

squid squid web proxy cache 2.0_patch2

squid squid web proxy cache 2.1_patch2

squid squid web proxy cache 2.5.stable11

squid squid web proxy cache 2.5.stable12

squid squid web proxy cache 2.5_stable4

squid squid web proxy cache 2.5_stable5

squid squid web proxy cache 2.6.stable14

squid squid web proxy cache 2.6.stable15

squid squid web proxy cache 2.6.stable7

squid squid web proxy cache 3.0

squid squid web proxy cache 2.4_stable2

squid squid web proxy cache 2.4_stable4

squid squid web proxy cache 2.5_.stable9

squid squid web proxy cache 2.5_stable1

squid squid web proxy cache 2.5_stable8

squid squid web proxy cache 2.6

squid squid web proxy cache 2.6.stable1

squid squid web proxy cache 2.6.stable3

squid squid web proxy cache 2.6.stable4

squid squid web proxy cache 3.0_pre3

squid squid web proxy cache 2.3.stable4

squid squid web proxy cache 2.3.stable5

squid squid web proxy cache 2.5.stable13

squid squid web proxy cache 2.5.stable14

squid squid web proxy cache 2.5_stable6

squid squid web proxy cache 2.5_stable7

squid squid web proxy cache 2.6.stable16

squid squid web proxy cache 2.6.stable2

squid squid web proxy cache 3.0_pre1

squid squid web proxy cache 3.0_pre2

squid squid web proxy cache 2.4_stable6

squid squid web proxy cache 2.4_stable7

squid squid web proxy cache 2.5_stable10

squid squid web proxy cache 2.5_stable3

squid squid web proxy cache 2.6.stable12

squid squid web proxy cache 2.6.stable13

squid squid web proxy cache 2.6.stable5

squid squid web proxy cache 2.6.stable6

Vendor Advisories

Debian CVElist Bug Report Logs: CVE-2007-6239: Denial of service via HTTP headers
Debian Bug report logs - #455910 CVE-2007-6239: Denial of service via HTTP headers Package: squid; Maintainer for squid is Luigi Gangitano <luigi@debianorg>; Source for squid is src:squid (PTS, buildd, popcon) Reported by: Micah Anderson <micah@debianorg> Date: Wed, 12 Dec 2007 14:33:04 UTC Severity: important Tag ...
Ubuntu Security Notice: squid vulnerability
It was discovered that Squid did not always clean up cache memory correctly A remote attacker could manipulate cache update replies and cause Squid to use all available memory, leading to a denial of service ...
Ubuntu Security Notice: squid vulnerability
It was discovered that Squid did not perform proper bounds checking when processing cache update replies A remote authenticated user may be able to trigger an assertion error and cause a denial of service This vulnerability is due to an incorrect upstream fix for CVE-2007-6239 (CVE-2008-1612) ...
Debian Security Advisories: DSA-1646-1 squid -- array bounds check
A weakness has been discovered in squid, a caching proxy server The flaw was introduced upstream in response to CVE-2007-6239, and announced by Debian in DSA-1482-1 The flaw involves an over-aggressive bounds check on an array resize, and could be exploited by an authorized client to induce a denial of service condition against squid For the sta ...
Debian Security Advisories: DSA-1482-1 squid -- programming error
It was discovered that malformed cache update replies against the Squid WWW proxy cache could lead to the exhaustion of system memory, resulting in potential denial of service For the old stable distribution (sarge), the update cannot currently be processed on the buildd security network due to a bug in the archive management script This will be ...

References

CWE-20http://www.squid-cache.org/Advisories/SQUID-2007_2.txthttp://www.squid-cache.org/Versions/v2/2.6/changesets/11780.patchhttp://www.securityfocus.com/bid/26687http://secunia.com/advisories/27910http://www.securitytracker.com/id?1019036https://bugzilla.redhat.com/show_bug.cgi?id=410181https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00507.htmlhttps://www.redhat.com/archives/fedora-package-announce/2007-December/msg00497.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:002http://www.redhat.com/support/errata/RHSA-2007-1130.htmlhttp://www.kb.cert.org/vuls/id/232881http://secunia.com/advisories/28091http://secunia.com/advisories/28109http://secunia.com/advisories/28350http://security.gentoo.org/glsa/glsa-200801-05.xmlhttp://www.ubuntu.com/usn/usn-565-1http://bugs.gentoo.org/show_bug.cgi?id=201209http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.htmlhttp://secunia.com/advisories/28381http://secunia.com/advisories/28403http://secunia.com/advisories/28412http://www.debian.org/security/2008/dsa-1482http://secunia.com/advisories/28814http://secunia.com/advisories/34467http://security.gentoo.org/glsa/glsa-200903-38.xmlhttp://www.vupen.com/english/advisories/2007/4066https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10915https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=455910https://usn.ubuntu.com/565-1/https://nvd.nist.govhttps://www.kb.cert.org/vuls/id/232881
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3581reflected XSSCVE-2024-26925CVE-2024-27956LFICVE-2024-3607CVE-2024-3107CVE-2024-3295SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook