| Vulnerability Name: | CVE-2002-0714 (CCN-9479) | ||||||||
| Assigned: | 2002-07-03 | ||||||||
| Published: | 2002-07-03 | ||||||||
| Updated: | 2016-10-18 | ||||||||
| Summary: | FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows remote attackers to bypass firewall rules or spoof FTP server responses. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||
| References: | Source: CALDERA Type: UNKNOWN CSSA-2002-046.0 Source: CCN Type: SCO Security Advisory CSSA-2003-SCO.9 Buffer overflows and other security vulnerabilities in Squid Source: MITRE Type: CNA CVE-2002-0714 Source: CONECTIVA Type: UNKNOWN CLA-2002:506 Source: CCN Type: Conectiva Linux Announcement CLSA-2002:506 squid Source: BUGTRAQ Type: UNKNOWN 20020715 TSLSA-2002-0062 - squid Source: CCN Type: Trustix Secure Linux Security Advisory #2002-0062 squid Source: CCN Type: RHSA-2002-051 New Squid packages available Source: REDHAT Type: UNKNOWN RHSA-2002:051 Source: CCN Type: RHSA-2002-130 squid security update Source: REDHAT Type: Patch, Vendor Advisory RHSA-2002:130 Source: XF Type: UNKNOWN squid-ftp-data-injection(9479) Source: MANDRAKE Type: Patch MDKSA-2002:044 Source: OSVDB Type: UNKNOWN 5924 Source: CCN Type: OSVDB ID: 5924 Squid Proxy FTP Channel Injection Source: BID Type: UNKNOWN 5158 Source: CCN Type: BID-5158 Squid FTP Proxy Data Channel Vulnerabilities Source: CCN Type: Squid Proxy Cache Security Update Advisory SQUID-2002:3 Squid Proxy Cache Security Update Advisory Source: CONFIRM Type: Patch, Vendor Advisory http://www.squid-cache.org/Advisories/SQUID-2002_3.txt Source: CONFIRM Type: Patch http://www.squid-cache.org/Versions/v2/2.4/bugs/ Source: XF Type: UNKNOWN squid-ftp-data-injection(9479) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||