Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2005-0241 | First vendor Publication | 2005-05-02 |
| Vendor | Cve | Last vendor Modification | 2017-10-11 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0241 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10998 | |||
| Oval ID: | oval:org.mitre.oval:def:10998 | ||
| Title: | Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack. | ||
| Description: | The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0241 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for squid File : nvt/sles9p5015273.nasl |
| 2009-10-10 | Name : SLES9: Security update for squid File : nvt/sles9p5020457.nasl |
| 2008-09-04 | Name : FreeBSD Ports: squid File : nvt/freebsd_squid0.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 13345 | Squid Oversized Reply Header Handling Security Issue |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Squid oversized reply header handling exploit attempt RuleID : 15580 - Revision : 12 - Type : SERVER-OTHER |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2005-07-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_bfda39de746711d99e1ec296ac722cb3.nasl - Type : ACT_GATHER_INFO |
| 2005-02-23 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2005_008.nasl - Type : ACT_GATHER_INFO |
| 2005-02-22 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-060.nasl - Type : ACT_GATHER_INFO |
| 2005-02-14 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-061.nasl - Type : ACT_GATHER_INFO |
| 2005-02-10 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2005_006.nasl - Type : ACT_GATHER_INFO |
| 2005-01-18 | Name : The remote proxy server is affected by multiple vulnerabilities. File : squid_wccp_and_gopher_flaws.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 12:02:45 |
|
| 2021-04-22 01:02:57 |
|
| 2020-05-23 00:16:19 |
|
| 2017-10-11 09:23:28 |
|
| 2017-07-11 12:01:48 |
|
| 2016-04-26 13:15:27 |
|
| 2014-02-17 10:29:57 |
|
| 2014-01-19 21:22:32 |
|
| 2013-05-11 11:20:44 |
|
