APP: Squid HTTP Version Number Parsing Denial of Service
This signature detects attempts to exploit a known vulnerability against Squid Proxy. It is due to inappropriate parsing the version number when processing malformed HTTP requests. Remote unauthenticated attackers can exploit this vulnerability by sending specially crafted HTTP request packets to an affected system. Successful exploitation may cause the service to terminate. Upon receiving a crafted HTTP request message, the Squid proxy server will terminate and reset all established connections. However, the Squid monitor process will re-spawn the worker process automatically which restores the proxy services. If the attack is launched continuously, the target Squid proxy may be put into a lasting denial-of-service condition.
Extended Description
Squid is prone to a remote denial-of-service vulnerability because the proxy server fails to handle certain HTTP requests. Successfully exploiting this issue allows remote attackers to crash the affected application, denying further service to legitimate users. This issue affects versions prior to Squid 2.7.STABLE5, Squid 3.0.STABLE12, and Squid 3.1.0.4.
Affected Products
Debian linux
Short Name
APP:SQUID-HTTPVER-DOS
Severity
Major
Recommended
False
Recommended Action
Drop
Category
APP
Keywords
CVE-2009-0478 Denial HTTP Number Parsing Service Squid Version bid:33604 of
Release Date
09/11/2013
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3339
Port
TCP/3128
False Positive
Unknown
Vendors
Red_hat
Gentoo
Squid
Ubuntu
Mandriva
Debian
CVSS Score
5.0