CVE-2005-0626 Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which all...
LowCVSS 2.6
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squid | = 2.5.stable5 | No fix listed |
| squid | = 2.5.stable6 | No fix listed |
| squid | = 2.5.stable7 | No fix listed |
| debian/squid(Debian:12) | < 2.5.9-2 | 2.5.9-2 |
| debian/squid(Debian:13) | < 2.5.9-2 | 2.5.9-2 |
| debian/squid(Debian:14) | < 2.5.9-2 | 2.5.9-2 |
References
- FLSA-2006:152809 vendor-advisory
- RHSA-2005:415 vendor-advisory
- 12716 vdb-entry
- www.squid-cache.org vendor-advisory
- squid-set-cookie-race-condition(19581) vdb-entry
- oval:org.mitre.oval:def:11169 signature vdb-entry
- USN-93-1 vendor-advisory
- Debian Security Tracker CVE-2005-0626 vendor-advisory