Description
The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue overload, which triggers an infinite loop.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | squid | 2.6.5-4 | — |
| Debian 13 | squid | 2.6.5-4 | — |
| Debian 12 | squid | 2.6.5-4 | — |
References
- http://www.squid-cache.org/Versions/v2/2.6/squid-2.6.STABLE7-RELEASENOTES.html#s12
- 22203 vdb-entry
- 23921 third-party-advisory
- 23946 third-party-advisory
- ADV-2007-0199 vdb-entry
- GLSA-200701-22 vendor-advisory
- SUSE-SA:2007:012 vendor-advisory
- MDKSA-2007:026 vendor-advisory
- squid-externalacl-dos(31525) vdb-entry
- USN-414-1 vendor-advisory
- 23805 third-party-advisory
- 23767 third-party-advisory
- 23889 third-party-advisory
- http://www.squid-cache.org/bugs/show_bug.cgi?id=1848