FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-0478

This CVE name corresponds to:

Entered	Topic
2009-02-09	squid -- remote denial of service vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-0478 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-0478
Phase	Assigned(20090208)

Description

Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c.

References

Source	Reference
BUGTRAQ	20090204 Squid Proxy Cache Denial of Service in request handling
MILW0RM	8021
CONFIRM	http://www.squid-cache.org/Advisories/SQUID-2009_1.txt
CONFIRM	http://www.squid-cache.org/Versions/v2/2.7/changesets/12432.patch
CONFIRM	https://bugzilla.redhat.com/show_bug.cgi?id=484246
GENTOO	GLSA-200903-38
MANDRIVA	MDVSA-2009:034
SUSE	SUSE-SR:2009:005
BID	33604
SECTRACK	1021684
SECUNIA	33731
SECUNIA	34467