CVE-2010-0639

Publication date 15 February 2010

Last updated 24 July 2024

Ubuntu priority

Description

The htcpHandleTstRequest function in htcp.c in Squid 2.x before 2.6.STABLE24 and 2.7 before 2.7.STABLE8, and htcp.cc in 3.0 before 3.0.STABLE24, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets to the HTCP port.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
squid	11.10 oneiric	Fixed in 2.7.STABLE7-1ubuntu6
	11.04 natty	Fixed in 2.7.STABLE7-1ubuntu6
	10.10 maverick	Fixed in 2.7.STABLE7-1ubuntu6
	10.04 LTS lucid	Fixed in 2.7.STABLE7-1ubuntu6
	9.10 karmic	Fixed in 2.7.STABLE6-2ubuntu2.2
	9.04 jaunty	Fixed in 2.7.STABLE3-4.1ubuntu1.2
	8.10 intrepid	Fixed in 2.7.STABLE3-1ubuntu2.3
	8.04 LTS hardy	Fixed in 2.6.18-1ubuntu3.2
	6.06 LTS dapper	Not affected
squid3	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Fixed in 3.0.STABLE19-1ubuntu0.2
	9.10 karmic	Ignored end of life
	9.04 jaunty	Ignored end of life
	8.10 intrepid	Ignored end of life, was needed
	8.04 LTS hardy	Ignored end of life
	6.06 LTS dapper	Not in release

Notes

mdeslaur

code not present in dapper (It's actually the htcpHandleClr function that is being patched here)

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
squid	Upstream: http://www.squid-cache.org/Versions/v2/2.7/changesets/12600.patch
squid3	Upstream: http://www.squid-cache.org/Versions/v3/3.0/changesets/3.0-ADV-2010_2.patch

References

Related Ubuntu Security Notices (USN)

USN-904-1
Squid vulnerability
24 February 2010