vulnwire
5.0med

CVE-2005-0174

Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
50.5%
percentile 99%
Public exploits
0
none known

Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.

Exploit prediction (EPSS)

50.49% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

References

  • redhat.com /archives/fedora-announce-list/2005-May/msg00025.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • squid-cache.org /Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/12412 · vdb-entry, x_refsource_BID, x_transferred
  • fedoranews.org /updates/FEDORA--.shtml · vendor-advisory, x_refsource_FEDORA, x_transferred
  • kb.cert.org /vuls/id/768702 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • www3.br.squid-cache.org /Advisories/SQUID-2005_4.txt · x_refsource_CONFIRM, x_transferred
  • redhat.com /support/errata/RHSA-2005-061.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000931 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10656 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2005:034 · vendor-advisory, x_refsource_MANDRAKE, x_transferred
  • marc.info /?l=bugtraq&m=110780531820947&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • novell.com /linux/security/advisories/2005_06_squid.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • redhat.com /support/errata/RHSA-2005-060.html · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.