Bug 484246 (CVE-2009-0478)
| Summary: | CVE-2009-0478 Squid denial of service flaw | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Josh Bressers <bressers> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | henrik, jonathansteffan, jskala, mnagy |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.squid-cache.org/Advisories/SQUID-2009_1.txt | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-02-13 13:17:08 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 484781, 484782 | ||
| Bug Blocks: | |||
|
Description
Josh Bressers
2009-02-05 16:24:59 UTC
The issue here is that a client request could be constructed in such a way that it triggers a call to assert() in the squid child process. This then causes the child process to quit, stopping all current requests until the child process is restarted. As this end up calling assert(), there is no potential for code execution from this particular flaw. The code that triggers this flaw is only present in squid versions 2.7 and above. https://admin.fedoraproject.org/updates/squid-3.0.STABLE13-1.fc10 https://admin.fedoraproject.org/updates/squid-3.0.STABLE13-1.fc9 Official Statement from Red Hat (02/09/2009)
Not vulnerable. This issue did not affect the version of Squid as
shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0478
This issue was addressed in: Fedora: https://admin.fedoraproject.org/updates/F10/FEDORA-2009-1526 https://admin.fedoraproject.org/updates/F9/FEDORA-2009-1517 |