CVE-2005-1345 Squid 2.5.STABLE9 and earlier does not trigger a fatal error when it identifies missing or invalid ACLs in the http_access configuration, which could lead to less restrictive ACLs than intended by the...
HighCVSS 7.5
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Squid 2.5.STABLE9 and earlier does not trigger a fatal error when it identifies missing or invalid ACLs in the http_access configuration, which could lead to less restrictive ACLs than intended by the administrator.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squid | = 2.5.stable1 | No fix listed |
| squid | = 2.5.stable2 | No fix listed |
| squid | = 2.5.stable3 | No fix listed |
| squid | = 2.5.stable4 | No fix listed |
| squid | = 2.5.stable5 | No fix listed |
| squid | = 2.5.stable6 | No fix listed |
| squid | = 2.5.stable7 | No fix listed |
| squid | = 2.5.stable8 | No fix listed |
| squid | = 2.5.stable9 | No fix listed |
| debian/squid(Debian:12) | < 2.5.9-7 | 2.5.9-7 |
| debian/squid(Debian:13) | < 2.5.9-7 | 2.5.9-7 |
| debian/squid(Debian:14) | < 2.5.9-7 | 2.5.9-7 |
References
- CLA-2005:948 vendor-advisory
- FLSA-2006:152809 vendor-advisory
- DSA-721 vendor-advisory
- RHSA-2005:415 vendor-advisory
- www.squid-cache.org patch
- www.squid-cache.org
- oval:org.mitre.oval:def:10513 signature vdb-entry
- Debian Security Tracker CVE-2005-1345 vendor-advisory