CVE-2005-0194 Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which....
HighCVSS 10.0
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squid | = 2.0.patch1 | No fix listed |
| squid | = 2.0.patch2 | No fix listed |
| squid | = 2.0.pre1 | No fix listed |
| squid | = 2.0.release | No fix listed |
| squid | = 2.1.patch1 | No fix listed |
| squid | = 2.1.patch2 | No fix listed |
| squid | = 2.1.pre1 | No fix listed |
| squid | = 2.1.pre3 | No fix listed |
| squid | = 2.1.pre4 | No fix listed |
| squid | = 2.1.release | No fix listed |
| squid | = 2.2.devel3 | No fix listed |
| squid | = 2.2.devel4 | No fix listed |
| squid | = 2.2.pre1 | No fix listed |
| squid | = 2.2.pre2 | No fix listed |
| squid | = 2.2.stable1 | No fix listed |
| squid | = 2.2.stable2 | No fix listed |
| squid | = 2.2.stable3 | No fix listed |
| squid | = 2.2.stable4 | No fix listed |
| squid | = 2.2.stable5 | No fix listed |
| squid | = 2.3.devel2 | No fix listed |
| squid | = 2.3.devel3 | No fix listed |
| squid | = 2.3.stable1 | No fix listed |
| squid | = 2.3.stable2 | No fix listed |
| squid | = 2.3.stable3 | No fix listed |
| squid | = 2.3.stable4 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| squid | = 2.3.stable5 | No fix listed |
| squid | = 2.4.stable1 | No fix listed |
| squid | = 2.4.stable2 | No fix listed |
| squid | = 2.4.stable3 | No fix listed |
| squid | = 2.4.stable4 | No fix listed |
| squid | = 2.4.stable6 | No fix listed |
| squid | = 2.4.stable7 | No fix listed |
| squid | = 2.5.stable1 | No fix listed |
| squid | = 2.5.stable2 | No fix listed |
| squid | = 2.5.stable3 | No fix listed |
| squid | = 2.5.stable4 | No fix listed |
| squid | = 2.5.stable5 | No fix listed |
| squid | = 2.5.stable6 | No fix listed |
| debian/squid(Debian:12) | < 2.5.7-7 | 2.5.7-7 |
| debian/squid(Debian:13) | < 2.5.7-7 | 2.5.7-7 |
| debian/squid(Debian:14) | < 2.5.7-7 | 2.5.7-7 |
References
- CLA-2005:923 patch vendor-advisory
- FLSA-2006:152809 vendor-advisory
- 20050221 [USN-84-1] Squid vulnerabilities mailing-list
- DSA-667 patch vendor-advisory
- VU#260421 patch third-party-advisory us-government-resource
- www.squid-cache.org patch
- www.squid-cache.org patch
- www.squid-cache.org vendor-advisory
- Debian Security Tracker CVE-2005-0194 vendor-advisory