vulnerability announce CVE-2010-0308

Squid: denial of service via DNS

Synthesis of the vulnerability

An attacker can send truncated DNS packets, in order to stop the Squid proxy.

Severity: 1/4. Creation date: 04/01/2010.

Description of the vulnerability

The Squid proxy implements a DNS resolver, which queries DNS servers and analyzes its answers. The rfc1035NameUnpack() function of the lib/rfc1035.c file decodes DNS packets. However, if the packet is truncated after its header, this function calls assert() which stops the program. An attacker, with a malicious DNS server, can therefore answer to Squid with short packets, in order to generate a denial of service.

Complete Vigil@nce bulletin

Access to the complete Vigil@nce bulletin

Characteristics

Title: Squid: denial of service via DNS. Keywords: DNS Squid denial rfc1035 rfc1035NameUnpack service. Identifiers: BID-37522, CVE-2010-0308, DSA 1991-1, MDVSA-2010:033, RHSA-2010:0221-04, SQUID-2010:1, SUSE-SR:2010:007, VIGILANCE-VUL-9322.

Information sources

Publications and announces Source example: Squid DNS Header Packet assert() DoS

Solutions for this vulnerability

Patch or workaround

Supplements

Attack Exploit 0day or proof of concept

Computer vulnerabilities tracking service

The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.
The Vigil@nce vulnerability database contains several thousand vulnerabilities.
This bulletin is published by the Vigil@nce team, which tracks computer vulnerabilities impacting systems and applications.
Security vulnerability alerts