FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

squid -- buffer overflow vulnerability in gopherToHTML

Affected packages
squid < 2.5.7_6

Details

VuXML ID 184ab9e0-64cd-11d9-9e1e-c296ac722cb3
Discovery 2005-01-11
Entry 2005-01-12
Modified 2005-01-22

The squid patches page notes:

A malicious gopher server may return a response with very long lines that cause a buffer overflow in Squid.

Workaround: Since gopher is very obscure these days, do not allow Squid to any gopher servers. Use an ACL rule like:

acl Gopher proto gopher
http_access deny Gopher

References

CVE Name CVE-2005-0094
URL http://www.squid-cache.org/Advisories/SQUID-2005_1.txt
URL http://www.squid-cache.org/bugs/show_bug.cgi?id=1189
URL http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing