CVE-2007-0247

Squid - Denial of Service via Crafted FTP Directory Listing Response

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-0247. PoCs published by David Duncan Ross Palmer.

AI-analyzed exploit summary This exploit demonstrates a denial-of-service vulnerability in Squid proxy server by sending a malformed FTP request. The vulnerability is triggered by a semicolon in the directory path, causing the server to crash.

Description

squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses, possibly related to the (1) ftpListingFinish and (2) ftpHtmlifyListEntry functions.

Exploits (1)

exploitdb WORKING POC VERIFIED
by David Duncan Ross Palmer · textdoslinux
https://www.exploit-db.com/exploits/29473

This exploit demonstrates a denial-of-service vulnerability in Squid proxy server by sending a malformed FTP request. The vulnerability is triggered by a semicolon in the directory path, causing the server to crash.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Squid versions 2.5.STABLE11 to 2.6.STABLE6
No auth needed
Prerequisites: Network access to the Squid proxy server
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (19)

Core 19
Core References
Various Sources x_refsource_confirm
http://www.squid-cache.org/bugs/show_bug.cgi?id=1857
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23921
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23946
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/22079
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/0199
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200701-22.xml
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23810
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2007_12_squid.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2007:026
Vendor Advisory vendor-advisory x_refsource_trustix
http://www.trustix.org/errata/2007/0003/
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-414-1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23837
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23805
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23767
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/39839
Mailing List vendor-advisory x_refsource_fedora
http://fedoranews.org/cms/node/2442
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23889
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/31523

Scores

EPSS 0.1909
EPSS Percentile 97.0%

Details

CWE
CWE-399
Status published
Products (6)
squid/squid 2.6.stable1
squid/squid 2.6.stable2
squid/squid 2.6.stable3
squid/squid 2.6.stable4
squid/squid 2.6.stable5
squid/squid 2.6.stable6
Published Jan 16, 2007
Tracked Since Feb 18, 2026