Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can send a malicious Range query to Squid, in order to
trigger a denial of service.

Impacted products: Debian, Fedora, MBS, RHEL, Squid, Ubuntu

Severity: 2/4

Creation date: 28/08/2014

DESCRIPTION OF THE VULNERABILITY

The HTTP Range header indicates the range of data to download. For
example:

Range: bytes=10-999

However, Squid does not check if the indicated value is an
integer, which triggers a fatal error.

An attacker can therefore send a malicious Range query to Squid,
in order to trigger a denial of service.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Squid-denial-of-service-via-Range-15239