CVE-2004-2654 The clientAbortBody function in client_side.c in Squid Web Proxy Cache before 2.6 STABLE6 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors that trigger...
MediumCVSS 5.0
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The clientAbortBody function in client_side.c in Squid Web Proxy Cache before 2.6 STABLE6 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors that trigger a null dereference. NOTE: in a followup advisory, a researcher claimed that the issue was a buffer overflow that was not fixed in STABLE6. However, the vendor's bug report clearly shows that the researcher later retracted this claim, because the tested product was actually STABLE5.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squid | = 2.5_stable5 | No fix listed |
| debian/squid(Debian:12) | < 2.5.6 | 2.5.6 |
| debian/squid(Debian:13) | < 2.5.6 | 2.5.6 |
| debian/squid(Debian:14) | < 2.5.6 | 2.5.6 |
References
- 12508 third-party-advisory vendor-advisory
- 12754 patch third-party-advisory vendor-advisory
- 1011214 vdb-entry
- 20060223 old Squid clientAbortBody issue - NOT an overflow? mailing-list
- 9801 vdb-entry
- www.securitylab.ru
- www.squid-cache.org
- Debian Security Tracker CVE-2004-2654 vendor-advisory