CVE Request -- Squid -- Denial of service due internal error in string handling (SQUID-2010:3)

[Jan Lieskovsky <jlieskov () redhat com>]

Hello Steve, vendors,

  Squid upstream has announced SQUID-2010:3:
  [1] http://www.squid-cache.org/Advisories/SQUID-2010_3.txt

  addressing one denial of service issue:
  A denial of service flaw was found in the way Squid proxy caching
  server internally processed NULL buffers. A remote, trusted client
  could use this flaw to cause squid daemon crash (dereference NULL pointer)
  when processing specially-crafted request.

  ( Flaw description based on details from [1]. Henrik, please correct / complete
    me if something isn't appropriate and needs change. Thanks, Jan )

  Upstream patch (against Squid v3.0):
  [2] http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9189.patch

  Upstream patch (against Squid v3.1):
  [3] http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10090.patch

  Credit:
  The vulnerability was discovered by Phil Oester.

  References:
  [4] https://bugzilla.redhat.com/show_bug.cgi?id=630444

Steve, could you please allocate CVE id for this issue?

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team