CVE-2002-0068

Current Description

Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service (core dump) and possibly execute arbitrary code with an ftp:// URL with a larger number of special characters, which exceed the buffer when Squid URL-escapes the characters.

Basic Data

PublishedMarch 08, 2002
Last ModifiedOctober 18, 2016
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeNVD-CWE-Other
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityLOW
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactPARTIAL
CVSS 2 - Availability ImpactPARTIAL
CVSS 2 - Base Score7.5
SeverityHIGH
Exploitability Score10.0
Impact Score6.4
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegetrue

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationSquidSquid********2.4_stable_3
  • OR - Configuration 2
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3OSRedhatLinux6.2*alpha*****
    2.3OSRedhatLinux6.2*i386*****
    2.3OSRedhatLinux6.2*sparc*****
    2.3OSRedhatLinux7.0*alpha*****
    2.3OSRedhatLinux7.0*i386*****
    2.3OSRedhatLinux7.1*alpha*****
    2.3OSRedhatLinux7.1*i386*****
    2.3OSRedhatLinux7.1*ia64*****
    2.3OSRedhatLinux7.2*i386*****
    2.3OSRedhatLinux7.2*ia64*****

Vulnerable Software List

VendorProductVersions
Redhat Linux 6.2, 7.0, 7.1, 7.2
Squid Squid *

References

NameSourceURLTags
FreeBSD-SA-02:12ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:12.squid.ascFREEBSD
CSSA-2002-SCO.7http://archives.neohapsis.com/archives/linux/caldera/2002-q1/0014.htmlCALDERA
CLA-2002:464http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000464CONECTIVA
20020221 Squid HTTP Proxy Security Update Advisory 2002:1http://marc.info/?l=bugtraq&m=101431040422095&w=2BUGTRAQ
20020222 Squid buffer overflowhttp://marc.info/?l=bugtraq&m=101440163111826&w=2BUGTRAQ
20020222 TSLSA-2002-0031 - squidhttp://marc.info/?l=bugtraq&m=101443252627021&w=2BUGTRAQ
CSSA-2002-010.0http://www.caldera.com/support/security/advisories/CSSA-2002-010.0.txtCALDERA
squid-ftpbuildtitleurl-bo(8258)http://www.iss.net/security_center/static/8258.phpXF
MDKSA-2002:016http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-016.phpMANDRAKE
SuSE-SA:2002:008http://www.novell.com/linux/security/advisories/2002_008_squid_txt.htmlSUSE
5378http://www.osvdb.org/5378OSVDB
RHSA-2002:029http://www.redhat.com/support/errata/RHSA-2002-029.htmlREDHATPatch Vendor Advisory
4148http://www.securityfocus.com/bid/4148BID
http://www.squid-cache.org/Versions/v2/2.4/bugs/http://www.squid-cache.org/Versions/v2/2.4/bugs/CONFIRMExploit