Squid: Denial of Service — GLSA 200801-05

A Denial of Service vulnerability has been reported in Squid.

Affected Packages

net-proxy/squid on all architectures
Affected versions < 2.6.17
Unaffected versions >= 2.6.17

Background

Squid is a multi-protocol proxy server.

Description

The Wikimedia Foundation reported a memory leak vulnerability when performing cache updates.

Impact

A remote attacker could perform numerous specially crafted requests to the vulnerable server, resulting in a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All Squid users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-proxy/squid-2.6.17"

References

Release Date
January 09, 2008

Latest Revision
January 09, 2008: 01

Severity
normal

Exploitable
remote

Bugzilla entries