FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2010-0308

This CVE name corresponds to:

Entered	Topic
2010-02-01	squid -- Denial of Service vulnerability in DNS handling

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2010-0308 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2010-0308
Phase	Assigned(20100112)

Description

lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header.

References

Source	Reference
MISC	http://events.ccc.de/congress/2009/Fahrplan/attachments/1483_26c3_ipv4_fuckups.pdf
MISC	http://www.squid-cache.org/Versions/v2/HEAD/changesets/12597.patch
MISC	http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9163.patch
MISC	http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-9853.patch
CONFIRM	http://www.squid-cache.org/Advisories/SQUID-2010_1.txt
BID	37522
OSVDB	62044
OVAL	oval:org.mitre.oval:def:11270
SECTRACK	1023520
SECUNIA	38451
SECUNIA	38455
VUPEN	ADV-2010-0260
XF	squid-dns-dos(56001)