1. CVE-Search
  2. CVE-2005-0174
ID CVE-2005-0174
Summary Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
References
Vulnerable Configurations
  • cpe:2.3:a:squid:squid:2.5.6:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5.6:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5.stable1:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5.stable1:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5.stable2:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5.stable2:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5.stable3:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5.stable3:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5.stable4:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5.stable4:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5.stable5:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5.stable5:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5.stable6:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5.stable6:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5.stable7:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5.stable7:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5_.stable1:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5_.stable1:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5_.stable3:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5_.stable3:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5_.stable4:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5_.stable4:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5_.stable5:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5_.stable5:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5_.stable6:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5_.stable6:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5_stable3:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5_stable3:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5_stable4:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5_stable4:*:*:*:*:*:*:*
  • cpe:2.3:a:squid:squid:2.5_stable9:*:*:*:*:*:*:*
    cpe:2.3:a:squid:squid:2.5_stable9:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 11-10-2017 - 01:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:P/A:N
oval via4
accepted 2013-04-29T04:07:28.795-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
family unix
id oval:org.mitre.oval:def:10656
status accepted
submitted 2010-07-09T03:56:16-04:00
title Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
version 29
redhat via4
advisories
  • rhsa
    id RHSA-2005:060
  • rhsa
    id RHSA-2005:061
rpms
  • squid-7:2.5.STABLE6-3.4E.3
  • squid-debuginfo-7:2.5.STABLE6-3.4E.3
  • squid-7:2.5.STABLE3-6.3E.7
  • squid-debuginfo-7:2.5.STABLE3-6.3E.7
refmap via4
bid 12412
bugtraq 20050207 [USN-77-1] Squid vulnerabilities
cert-vn VU#768702
conectiva CLA-2005:931
confirm
fedora
  • FEDORA-2005-373
  • FLSA-2006:152809
mandrake MDKSA-2005:034
suse SUSE-SA:2005:006
Last major update 11-10-2017 - 01:29
Published 07-02-2005 - 05:00
Last modified 11-10-2017 - 01:29
Back to Top