diff options
| author | miwi <miwi@FreeBSD.org> | 2007-03-21 21:04:08 +0800 |
|---|---|---|
| committer | miwi <miwi@FreeBSD.org> | 2007-03-21 21:04:08 +0800 |
| commit | 039a1a36ae26dd8dc7ddca7e4ca269127ae70dca (patch) | |
| tree | 20e74d732f906e90455fd38f923850339b85aea9 /security | |
| parent | af71b11ebc10039a77388d24201bd9ed95cc83bb (diff) | |
| download | freebsd-ports-graphics-039a1a36ae26dd8dc7ddca7e4ca269127ae70dca.tar.gz freebsd-ports-graphics-039a1a36ae26dd8dc7ddca7e4ca269127ae70dca.tar.zst freebsd-ports-graphics-039a1a36ae26dd8dc7ddca7e4ca269127ae70dca.zip | |
- Add entry for squid TRACE method handling denial of service
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index e74e9026e28..5ec8d8aea24 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,39 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="c27bc173-d7aa-11db-b141-0016179b2dd5"> + <topic>Squid -- TRACE method handling denial of service</topic> + <affects> + <package> + <name>squid</name> + <range><ge>2.6.1</ge></range> + <range><lt>2.6.12</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Squid advisory 2007:1 notes:</p> + <blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2007_1.txt"> + <p>Due to an internal error Squid-2.6 is vulnerable to a denial of + service attack when processing the TRACE request method.</p> + <p>Workarounds:</p> + <p>To work around the problem deny access to using the TRACE method by + inserting the following two lines before your first http_access + rule.</p> + <p>acl TRACE method TRACE</p> + <p>http_access deny TRACE</p> + </blockquote> + </body> + </description> + <references> + <url>http://www.squid-cache.org/Advisories/SQUID-2007_1.txt</url> + </references> + <dates> + <discovery>2007-03-21</discovery> + <entry>2007-03-20</entry> + </dates> + </vuln> + <vuln vid="8e02441d-d39c-11db-a6da-0003476f14d3"> <topic>sql-ledger -- security bypass vulnerability</topic> <affects> |