Bug 156699

Summary:	CAN-2005-1389 HTTP Response Splitting Vulnerabilities
Product:	Red Hat Enterprise Linux 4	Reporter:	Josh Bressers <bressers>
Component:	squid	Assignee:	Jay Fenlason <fenlason>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	low	Docs Contact:
Priority:	medium
Version:	4.0	CC:	jfeeney
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=low,public=20050423,source=cve,reported=20050502
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-05-06 15:34:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2005-05-03 14:33:25 UTC

Squid is susceptible to a class of attacks known as "HTTP Response
Splitting."  These attacks involve tricking servers into sending
malformed or unexpected HTTP responses by exploiting weaknesses
in input validation on dynamic pages. This may in some situations
lead to cache poisoning.

http://www.squid-cache.org/Advisories/SQUID-2005_5.txt

Comment 1 Josh Bressers 2005-05-03 14:39:49 UTC

This issue should also affect RHEL2.1 and RHEL3

Comment 2 Josh Bressers 2005-05-06 15:34:46 UTC


*** This bug has been marked as a duplicate of 146161 ***