National Cyber Awareness System

Vulnerability Summary for CVE-2012-5643

Overview

Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch

Type: Patch Information

Hyperlink:http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch

External Source: CONFIRM

Name: http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch

Type: Patch Information

Hyperlink:http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch

External Source: CONFIRM

Name: http://www.squid-cache.org/Advisories/SQUID-2012_1.txt

Type: Advisory; Patch Information

Hyperlink:http://www.squid-cache.org/Advisories/SQUID-2012_1.txt

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=887962

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=887962

External Source: CONFIRM

Name: https://bugs.gentoo.org/show_bug.cgi?id=447596

Hyperlink:https://bugs.gentoo.org/show_bug.cgi?id=447596

External Source: SECTRACK

Name: 1027890

Hyperlink:http://www.securitytracker.com/id?1027890

External Source: DEBIAN

Name: DSA-2631

Hyperlink:http://www.debian.org/security/2013/dsa-2631

External Source: UBUNTU

Name: USN-1713-1

Hyperlink:http://ubuntu.com/usn/usn-1713-1

External Source: SECUNIA

Name: 52024

Hyperlink:http://secunia.com/advisories/52024

External Source: REDHAT

Name: RHSA-2013:0505

Hyperlink:http://rhn.redhat.com/errata/RHSA-2013-0505.html

External Source: MLIST

Name: [oss-security] 20121217 Re: CVE Request -- SQUID-2012:1 / Squid: DoS (excessive resource consumption) via invalid Content-Length headers or via memory leaks

Hyperlink:http://openwall.com/lists/oss-security/2012/12/17/4

External Source: SUSE

Name: openSUSE-SU-2013:0186

Hyperlink:http://lists.opensuse.org/opensuse-updates/2013-01/msg00075.html

External Source: SUSE

Name: openSUSE-SU-2013:0162

Hyperlink:http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html