Unscored severity · published Feb 7, 2005
CVE-2005-0174
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple…
–
CVSS
50.5%
EPSS
No
On KEV
Description
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
Exploitation
Is it being used?
Exploit prediction (EPSS)50.5% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Squid · Squid
2.5.6; 2.5.stable1; 2.5.stable2; 2.5.stable3; 2.5.stable4; 2.5.stable5; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-0174
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-0174
Vendor Advisory
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000931
fedoranews.org
http://fedoranews.org/updates/FEDORA--.shtml
marc.info
http://marc.info/?l=bugtraq&m=110780531820947&w=2
Third Party Advisory
http://www.kb.cert.org/vuls/id/768702
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDKSA-2005:034
Vendor Advisory
http://www.novell.com/linux/security/advisories/2005_06_squid.html
More from Squid
–
CVE-2009-0478
Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which…
–
CVE-2008-1612
The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17 allows attackers to cause a denial of service (process exit) via unknown vectors that cause an array to shrink to 0…
–
CVE-2007-1560
The clientProcessRequest() function in src/client_side.c in Squid 2.6 before 2.6.STABLE12 allows remote attackers to cause a denial of service (daemon crash) via crafted TRACE…
–
CVE-2007-0248
The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue overload, which triggers an…
–
CVE-2007-0247
squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses, possibly related to the…