Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Web Server/CGI)  >   Squid Vendors:
Squid ICMP Bugs Let Remote Users Deny Service and Local Users Obtain Potentially Sensitive Information
SecurityTracker Alert ID:  1031261
SecurityTracker URL:
CVE Reference:   CVE-2014-7141, CVE-2014-7142   (Links to External Site)
Date:  Nov 25 2014
Impact:   Denial of service via network, Disclosure of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.x prior to 3.4.8
Description:   Two vulnerabilities were reported in Squid. A remote user can cause denial of service conditions. A local user can obtain potentially sensitive information.

A remote user can send specially crafted ICMP or ICMPv6 packets to deny service on the target Squid pinger binary or cause the binary to leak potentially sensitive information from the heap to Squid log files.

Sebastian Krahmer of the OpenSUSE Project and Amos Jeffries of Treehouse Networks Ltd. reported these vulnerabilities.

Impact:   A remote user can cause denial of service conditions.

A remote local can obtain potentially sensitive information from the heap.

Solution:   The vendor has issued a fix (3.4.8).

The vendor's advisory is available at:

Vendor URL: (Links to External Site)
Cause:   Boundary error, Input validation error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.

 Source Message Contents

[Original Message Not Available for Viewing]

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC