CVE-2009-0478

Squid <3.1.0.4 - DoS

Title source: llm

Description

Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Praveen Darshanam · perldosmultiple

https://www.exploit-db.com/exploits/8021

View Code ZIP pw:eip

References (12)

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html

[Vendor Advisory] http://secunia.com/advisories/33731

[Vendor Advisory] http://secunia.com/advisories/34467

[Vendor Advisory] http://www.mandriva.com/security/advisories?name=MDVSA-2009:034

[Exploit, Patch] http://www.securityfocus.com/bid/33604

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1021684

[Vendor Advisory] http://www.squid-cache.org/Advisories/SQUID-2009_1.txt

[Vendor Advisory] http://www.squid-cache.org/Versions/v2/2.7/changesets/12432.patch

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=484246

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/500653/100/0/threaded

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/8021

[Third Party Advisory] http://security.gentoo.org/glsa/glsa-200903-38.xml

Scores

EPSS 0.7705

EPSS Percentile 99.0%

Details

CWE

CWE-20

Status published

Products (22)

squid/squid 2.7.stable1

squid/squid 2.7.stable2

squid/squid 2.7.stable3

squid/squid 2.7.stable4

squid/squid 2.7.stable5

squid/squid 3.0.stable1

squid/squid 3.0.stable2

squid/squid 3.0.stable3

squid/squid 3.0.stable4

squid/squid 3.0.stable5

... and 12 more

Published Feb 08, 2009

Tracked Since Feb 18, 2026