| ID |
CVE-2004-2654
|
| Summary |
The clientAbortBody function in client_side.c in Squid Web Proxy Cache before 2.6 STABLE6 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors that trigger a null dereference. NOTE: in a followup advisory, a researcher claimed that the issue was a buffer overflow that was not fixed in STABLE6. However, the vendor's bug report clearly shows that the researcher later retracted this claim, because the tested product was actually STABLE5. |
| References |
|
| Vulnerable Configurations |
|
| CVSS |
| Base: | 5.0 (as of 05-09-2008 - 20:44) |
| Impact: | |
| Exploitability: | |
|
| CWE |
NVD-CWE-Other |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
LOW |
NONE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| NONE |
NONE |
PARTIAL |
|
| cvss-vector
via4
|
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
| refmap
via4
|
| misc | | | osvdb | 9801 | | sectrack | 1011214 | | secunia | | | vim | 20060223 old Squid clientAbortBody issue - NOT an overflow? |
|
| statements
via4
|
| contributor | Mark J Cox | | lastmodified | 2006-08-30 | | organization | Red Hat | | statement | Not vulnerable. This issue only affected 2.5 STABLE4 and 2.5 STABLE5 versions of Squid and does not affect the versions of Squid distributed with Red Hat Enterprise Linux. |
|
| Last major update |
05-09-2008 - 20:44 |
| Published |
31-12-2004 - 05:00 |
| Last modified |
05-09-2008 - 20:44 |
