CVE-2001-1030 Squid before 2.3STABLE5 in HTTP accelerator mode does not enable access control lists (ACLs) when the httpd_accel_host and http_accel_with_proxy off settings are used, which allows attackers to bypass...
HighCVSS 7.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Squid before 2.3STABLE5 in HTTP accelerator mode does not enable access control lists (ACLs) when the httpd_accel_host and http_accel_with_proxy off settings are used, which allows attackers to bypass the ACLs and conduct unauthorized activities such as port scanning.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| caldera openlinux server | = 3.1 | No fix listed |
| immunix | = 6.2 | No fix listed |
| immunix | = 7.0 | No fix listed |
| immunix | = 7.0_beta | No fix listed |
| mandrakesoft mandrake single network firewall | = 7.2 | No fix listed |
| squid web proxy | = 2.3stable3 | No fix listed |
| squid web proxy | = 2.3stable4 | No fix listed |
| mandrakesoft mandrake linux | = 7.1 | No fix listed |
| mandrakesoft mandrake linux | = 7.2 | No fix listed |
| mandrakesoft mandrake linux | = 8.0 | No fix listed |
| mandrakesoft mandrake linux corporate server | = 1.0.1 | No fix listed |
| redhat linux | = 7.0 | No fix listed |
| trustix secure linux | = 1.1 | No fix listed |
| trustix secure linux | = 1.01 | No fix listed |
| trustix secure linux | = 1.2 | No fix listed |
References
- 20010719 TSLSA-2001-0013 - Squid mailing-list patch vendor-advisory
- IMNX-2001-70-031-01 patch vendor-advisory
- CSSA-2001-029.0 vendor-advisory
- MDKSA-2001:066 vendor-advisory
- RHSA-2001:097 patch vendor-advisory
- 20010718 Squid httpd acceleration acl bug enables portscanning mailing-list patch vendor-advisory
- squid-http-accelerator-portscanning(6862) vdb-entry