Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) "missing or mismatched protocol identifier," (2) missing or negative status value," (3) "missing version," or (4) "missing or invalid status number," related to (a) HttpMsg.cc and (b) HttpReply.cc.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 5.0 | MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Not vulnerable. This issue did not affect the versions of squid as shipped with Red Hat Enterprise Linux 3, 4, or 5.
| Hyperlink | Source | Resource |
|---|---|---|
| http://secunia.com/advisories/36007 | cret@cert.org | N/A |
| http://www.mandriva.com/security/advisories?name=MDVSA-2009:161 | cret@cert.org | N/A |
| http://www.mandriva.com/security/advisories?name=MDVSA-2009:178 | cret@cert.org | N/A |
| http://www.securityfocus.com/bid/35812 | cret@cert.org | N/A |
| http://www.securitytracker.com/id?1022607 | cret@cert.org | N/A |
| http://www.squid-cache.org/Advisories/SQUID-2009_2.txt | cret@cert.org | Vendor Advisory |
| http://www.squid-cache.org/Versions/v3/3.1/changesets/b9661.patch | cret@cert.org | Patch Vendor Advisory |
| http://www.vupen.com/english/advisories/2009/2013 | cret@cert.org | N/A |