Description
Squid 2.5.STABLE10 and earlier, while performing NTLM authentication, does not properly handle certain request sequences, which allows attackers to cause a denial of service (daemon restart).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | squid | 2.5.10-7 | — |
| Debian 13 | squid | 2.5.10-7 | — |
| Debian 12 | squid | 2.5.10-7 | — |
| Debian 3.1 | squid | 2.5.9-10sarge2 | DSA-828-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | squid | 7:2.5.STABLE6-3.4E.12 | RHSA-2006:0052 |
| RHEL 3 | squid | 7:2.5.STABLE3-6.3E.16 | RHSA-2006:0045 |
Advisories 3
- RHSA-2006:0052 Red Hat Security Advisory: squid security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0045 Red Hat Security Advisory: squid security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-828-1 squid - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-192-1 vendor-advisory
- 1014920 vdb-entry
- 16992 third-party-advisory
- 14977 vdb-entry
- 19607 vdb-entry
- MDKSA-2005:181 vendor-advisory
- squid-ntlm-authentication-dos(24282) vdb-entry
- FLSA-2006:152809 vendor-advisory
- 17050 third-party-advisory
- RHSA-2006:0052 vendor-advisory
- oval:org.mitre.oval:def:11580 vdb-entry signature
- 19532 third-party-advisory
- 17177 third-party-advisory
- 19161 third-party-advisory
- 17015 third-party-advisory
- RHSA-2006:0045 vendor-advisory
- DSA-828 vendor-advisory
- SUSE-SR:2005:027 vendor-advisory