Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2009-0478: Squid proxy can crash from malformed HTTP request
CVE-2009-0478 · published 17 years ago
Summary
The Squid proxy software packaged for Debian can stop working if it receives an HTTP request with an incorrect version number. An attacker on the network can exploit this to make the proxy unavailable, affecting web access for users. Upgrade to the latest patched Squid version or apply the vendor’s security update to prevent the crash.
What to do
- Update debian squid to version 2.7.STABLE3-4.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | squid |
< 2.7.STABLE3-4.1 Fix: upgrade to 2.7.STABLE3-4.1
|
| Debian:13 | debian | squid |
< 2.7.STABLE3-4.1 Fix: upgrade to 2.7.STABLE3-4.1
|
| Debian:14 | debian | squid |
< 2.7.STABLE3-4.1 Fix: upgrade to 2.7.STABLE3-4.1
|
| – | squid | squid |
2.7.stable1 2.7.stable2 2.7.stable3 2.7.stable4 2.7.stable5 3.0.stable1 3.0.stable2 3.0.stable3 3.0.stable4 3.0.stable5 3.0.stable6 3.0.stable7 10 more version ranges
cpe:2.3:a:squid:squid:2.7.stable1:*:*:*:*:*:*:* |
Original advisory text
Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable...
Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c.
References
- https://security-tracker.debian.org/tracker/CVE-2009-0478 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html
- http://secunia.com/advisories/33731 Vendor Advisory
- http://secunia.com/advisories/34467 Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200903-38.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:034
- http://www.securityfocus.com/archive/1/500653/100/0/threaded
- http://www.securityfocus.com/bid/33604 Exploit Patch
- http://www.securitytracker.com/id?1021684
- http://www.squid-cache.org/Advisories/SQUID-2009_1.txt Vendor Advisory
- http://www.squid-cache.org/Versions/v2/2.7/changesets/12432.patch Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=484246
- https://www.exploit-db.com/exploits/8021
Severity
5.0
Medium
Type
CWE-20Improper Input Validation
Timeline
Published8 Feb 2009
Updated29 Sep 2026
First seen17 Sep 2026
Track software like this
Free during beta