Description
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.
References (7)
Core 7
Core References
Mailing List mailing-list
x_refsource_mlist
http://openwall.com/lists/oss-security/2014/09/15/6
Third Party Advisory vendor-advisory
x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201409-07.xml
Exploit x_refsource_misc
http://osvdb.org/ref/89/c-icap.txt
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/89304
Product x_refsource_confirm
http://sourceforge.net/p/c-icap/code/1018/
Third Party Advisory x_refsource_confirm
http://advisories.mageia.org/MGASA-2014-0530.html
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2015:001
Scores
EPSS
0.0282
EPSS Percentile
84.9%
Details
CWE
CWE-119
Status
published
Products (6)
c-icap_project/c-icap
0.2.1
c-icap_project/c-icap
0.2.2
c-icap_project/c-icap
0.2.3
c-icap_project/c-icap
0.2.4
c-icap_project/c-icap
0.2.5
c-icap_project/c-icap
0.2.6
Published
Dec 19, 2014
Tracked Since
Feb 18, 2026