National Cyber-Alert System

Vulnerability Summary for CVE-2008-1612

Overview

The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17 allows attackers to cause a denial of service (process exit) via unknown vectors that cause an array to shrink to 0 entries, which triggers an assert error. NOTE: this issue is due to an incorrect fix for CVE-2007-6239.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://www.squid-cache.org/Advisories/SQUID-2007_2.txt

Type: Patch Information

Hyperlink:http://www.squid-cache.org/Advisories/SQUID-2007_2.txt

External Source: MISC

Name: http://www.squid-cache.org/Versions/v2/2.6/changesets/11882.patch

Hyperlink:http://www.squid-cache.org/Versions/v2/2.6/changesets/11882.patch

External Source: MLIST

Name: [oss-security] 20080401 CVE id request: squid

Hyperlink:http://www.openwall.com/lists/oss-security/2008/04/01/5

External Source: MANDRIVA

Name: MDVSA-2008:134

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:134

External Source: DEBIAN

Name: DSA-1646

Hyperlink:http://www.debian.org/security/2008/dsa-1646

External Source: GENTOO

Name: GLSA-200903-38

Hyperlink:http://security.gentoo.org/glsa/glsa-200903-38.xml

External Source: SECUNIA

Name: 34467

Hyperlink:http://secunia.com/advisories/34467

External Source: SECUNIA

Name: 32109

Hyperlink:http://secunia.com/advisories/32109

External Source: MLIST

Name: [squid-announce[ 20080322 Advisory Squid-2007:2 updated

Hyperlink:http://marc.info/?l=squid-announce&m=120614453813157&w=2

External Source: FEDORA

Name: FEDORA-2008-2740

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00560.html

External Source: XF

Name: squid-arrayshrink-dos(41586)

Hyperlink:http://xforce.iss.net/xforce/xfdb/41586

External Source: UBUNTU

Name: USN-601-1

Hyperlink:http://www.ubuntu.com/usn/usn-601-1

External Source: BID

Name: 28693

Hyperlink:http://www.securityfocus.com/bid/28693

External Source: REDHAT

Name: RHSA-2008:0214

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0214.html

External Source: SECUNIA

Name: 30032

Hyperlink:http://secunia.com/advisories/30032

External Source: SECUNIA

Name: 29813

Hyperlink:http://secunia.com/advisories/29813

External Source: SECUNIA

Name: 27477

Hyperlink:http://secunia.com/advisories/27477

External Source: SUSE

Name: SUSE-SR:2008:011

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html