Short Name |
APP:SQUID-HTTPVER-DOS |
---|---|
Severity |
Major |
Recommended |
No |
Recommended Action |
Drop |
Category |
APP |
Keywords |
Squid HTTP Version Number Parsing Denial of Service |
Release Date |
2013/09/11 |
Update Number |
2299 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
This signature detects attempts to exploit a known vulnerability against Squid Proxy. It is due to inappropriate parsing the version number when processing malformed HTTP requests. Remote unauthenticated attackers can exploit this vulnerability by sending specially crafted HTTP request packets to an affected system. Successful exploitation may cause the service to terminate. Upon receiving a crafted HTTP request message, the Squid proxy server will terminate and reset all established connections. However, the Squid monitor process will re-spawn the worker process automatically which restores the proxy services. If the attack is launched continuously, the target Squid proxy may be put into a lasting denial-of-service condition.
Squid is prone to a remote denial-of-service vulnerability because the proxy server fails to handle certain HTTP requests. Successfully exploiting this issue allows remote attackers to crash the affected application, denying further service to legitimate users. This issue affects versions prior to Squid 2.7.STABLE5, Squid 3.0.STABLE12, and Squid 3.1.0.4.