Bug 53906 - Squid allows all proxy requests in accelerator mode
Squid allows all proxy requests in accelerator mode
Product: Red Hat Linux
Classification: Retired
Component: squid (Show other bugs)
All Linux
high Severity medium
: ---
: ---
Assigned To: Bill Nottingham
: Security
Depends On:
  Show dependency treegraph
Reported: 2001-09-21 05:47 EDT by bastiaan
Modified: 2014-03-16 22:23 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2001-09-21 05:47:49 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2001:113 normal SHIPPED_LIVE : New squid packages available to fix FTP-based DoS 2001-09-25 00:00:00 EDT

  None (edit)
Description bastiaan 2001-09-21 05:47:45 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.4.6 i686; en-US; rv:0.9.1)

Description of problem:
If squid is configured in acccelerator only mode, it will serve any proxy
request sent to the HTTP port.
This is a known security bug fixed over a year ago (see the ChangeLog of

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.telnet squidaccel server 80
2.GET http://random.remote.server.com/ HTTP/1.0 

Actual Results:  Squid serves the page. 

Expected Results:  It should refuse the request.

Additional info:

This bug has been fixed in Squid 2.3stable5 with patch:

This squid website reports this bug was introduces in stable2, but RedHats
stable1 release also has it, due to inclusion of this patch:
Comment 1 Bill Nottingham 2001-10-17 10:03:22 EDT
This was fixed in the recent errata release of Squid for 6.2.

Note You need to log in before you can comment on or make changes to this bug.