CVE-2005-0174 Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers,...
MediumCVSS 5.0
EPSS 50.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squid | = 2.5.6 | No fix listed |
| squid | = 2.5.stable1 | No fix listed |
| squid | = 2.5.stable2 | No fix listed |
| squid | = 2.5.stable3 | No fix listed |
| squid | = 2.5.stable4 | No fix listed |
| squid | = 2.5.stable5 | No fix listed |
| squid | = 2.5.stable6 | No fix listed |
| squid | = 2.5.stable7 | No fix listed |
| squid | = 2.5_.stable1 | No fix listed |
| squid | = 2.5_.stable3 | No fix listed |
| squid | = 2.5_.stable4 | No fix listed |
| squid | = 2.5_.stable5 | No fix listed |
| squid | = 2.5_.stable6 | No fix listed |
| squid | = 2.5_stable3 | No fix listed |
| squid | = 2.5_stable4 | No fix listed |
| squid | = 2.5_stable9 | No fix listed |
| debian/squid(Debian:12) | < 2.5.7-6 | 2.5.7-6 |
| debian/squid(Debian:13) | < 2.5.7-6 | 2.5.7-6 |
| debian/squid(Debian:14) | < 2.5.7-6 | 2.5.7-6 |
References
- CLA-2005:931 vendor-advisory
- FLSA-2006:152809 vendor-advisory
- 20050207 [USN-77-1] Squid vulnerabilities mailing-list
- VU#768702 third-party-advisory us-government-resource
- MDKSA-2005:034 vendor-advisory
- SUSE-SA:2005:006 vendor-advisory
- FEDORA-2005-373 vendor-advisory
- RHSA-2005:060 patch vendor-advisory
- RHSA-2005:061 patch vendor-advisory
- 12412 vdb-entry
- www.squid-cache.org vendor-advisory
- www3.br.squid-cache.org
- oval:org.mitre.oval:def:10656 signature vdb-entry
- Debian Security Tracker CVE-2005-0174 vendor-advisory