Description
Squid 2.4 STABLE3 and earlier does not properly disable HTCP, even when "htcp_port 0" is specified in squid.conf, which could allow remote attackers to bypass intended access restrictions.
References
- http://www.squid-cache.org/Versions/v2/2.4/bugs/
- CLA-2002:464 vendor-advisory
- MDKSA-2002:016 vendor-advisory
- 20020222 TSLSA-2002-0031 - squid mailing-list
- CSSA-2002-SCO.7 vendor-advisory
- squid-htcp-enabled(8261) vdb-entry
- 4150 vdb-entry
- 20020221 Squid HTTP Proxy Security Update Advisory 2002:1 mailing-list
- RHSA-2002:029 vendor-advisory
- 5379 vdb-entry