Squid security advisory SQUID-2007:2 was released on 2007-11-27 describing potential denial of service (DoS) bug in squid proxy server: http://www.squid-cache.org/Advisories/SQUID-2007_2.txt The advisory was now updated to address problem introduced by the fix: http://marc.info/?l=squid-announce&m=120614453813157&w=2 Following patch is need to allow shrinking squid Arrays to zero-sized arrays: http://www.squid-cache.org/Versions/v2/2.6/changesets/11882.patch
Issue was previously tracked using bug bug #410181.
This issue was introduced in the original fix for SQUID-2007_2. An attacker can possibly cause squid child process to exit due to a failed assert. New child process is spawned by the parent squid process to replace exited child. Child process exit can easily interrupt current connections of other users. Issue affects squid packages currently shipped in Red Hat Enterprise Linux 2.1, 3, 4, and 5.
This issue was addressed in: Red Hat Enterprise Linux: http://rhn.redhat.com/errata/RHSA-2008-0214.html