Re: CVE Request -- Squid -- Denial of service due internal error in string handling (SQUID-2010:3)

[Josh Bressers <bressers () redhat com>]

Please use CVE-2010-3072

Thanks.

-- 
    JB


----- "Jan Lieskovsky" <jlieskov () redhat com> wrote:

> Hello Steve, vendors,
>
>    Squid upstream has announced SQUID-2010:3:
>    [1] http://www.squid-cache.org/Advisories/SQUID-2010_3.txt
>
>    addressing one denial of service issue:
>    A denial of service flaw was found in the way Squid proxy caching
>    server internally processed NULL buffers. A remote, trusted client
>    could use this flaw to cause squid daemon crash (dereference NULL
> pointer)
>    when processing specially-crafted request.
>
>    ( Flaw description based on details from [1]. Henrik, please
> correct / complete
>      me if something isn't appropriate and needs change. Thanks, Jan
> )
>
>    Upstream patch (against Squid v3.0):
>    [2]
> http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9189.patch
>
>    Upstream patch (against Squid v3.1):
>    [3]
> http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10090.patch
>
>    Credit:
>    The vulnerability was discovered by Phil Oester.
>
>    References:
>    [4] https://bugzilla.redhat.com/show_bug.cgi?id=630444
>
> Steve, could you please allocate CVE id for this issue?
>
> Thanks && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team