Vulnerability Name:

CVE-2005-0446 (CCN-19332)

Assigned:2005-02-13
Published:2005-02-13
Updated:2017-10-11
Summary:Squid 2.5.STABLE8 and earlier allows remote attackers to cause a denial of service (crash) via certain DNS responses regarding (1) Fully Qualified Domain Names (FQDN) in fqdncache.c or (2) IP addresses in ipcache.c, which trigger an assertion failure.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2005-0446

Source: CONECTIVA
Type: Patch, Vendor Advisory
CLA-2005:931

Source: FEDORA
Type: UNKNOWN
FLSA-2006:152809

Source: BUGTRAQ
Type: UNKNOWN
20050221 [USN-84-1] Squid vulnerabilities

Source: CCN
Type: RHSA-2005-173
squid security update

Source: CCN
Type: RHSA-2005-201
squid security update

Source: CCN
Type: SA14271
Squid FQDN Lookup Denial of Service Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
14271

Source: DEBIAN
Type: Patch, Vendor Advisory
DSA-688

Source: DEBIAN
Type: DSA-688
squid -- missing input sanitising

Source: CCN
Type: GLSA-200502-25
Squid: Denial of Service through DNS responses

Source: GENTOO
Type: Patch, Vendor Advisory
GLSA-200502-25

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2005:047

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2005:173

Source: REDHAT
Type: UNKNOWN
RHSA-2005:201

Source: BID
Type: UNKNOWN
12551

Source: CCN
Type: BID-12551
Squid Proxy DNS Name Resolver Remote Denial Of Service Vulnerability

Source: CCN
Type: Squid 2.5 Patch Web page
Squid-2.5 Patches

Source: CONFIRM
Type: Patch
http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert

Source: CONFIRM
Type: Patch
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE8-dns_assert.patch

Source: CCN
Type: TLSA-2005-31
Squid denial of service attack

Source: CCN
Type: USN-84-1
Squid vulnerabilities

Source: XF
Type: UNKNOWN
squid-xstrndup-dos(19332)

Source: XF
Type: UNKNOWN
squid-xstrndup-dos(19332)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:11264

Source: SUSE
Type: SUSE-SA:2005:008
squid: remote denial of service

Vulnerable Configuration:Configuration 1:
  • cpe:/a:squid:squid:2.0.patch1:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.0.patch2:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.0.pre1:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.0.release:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.0_patch2:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.1.patch1:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.1.patch2:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.1.pre1:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.1.pre3:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.1.pre4:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.1.release:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.1_patch2:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.2.devel3:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.2.devel4:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.2.pre1:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.2.pre2:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.2.stable1:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.2.stable2:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.2.stable3:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.2.stable4:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.2.stable5:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.3.devel2:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.3.devel3:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.3.stable1:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.3.stable2:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.3.stable3:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.3.stable4:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.3.stable5:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.3_.stable4:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.3_.stable5:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.3_stable5:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.4:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.4.stable1:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.4.stable2:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.4.stable3:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.4.stable4:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.4.stable6:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.4.stable7:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.4_.stable2:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.4_.stable6:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.4_.stable7:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.4_stable7:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5.stable1:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5.stable2:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5.stable3:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5.stable4:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5.stable5:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5.stable6:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5.stable7:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5.stable8:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5_.stable1:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5_.stable3:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5_.stable4:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5_.stable5:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5_.stable6:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5_stable3:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5_stable4:*:*:*:*:*:*:*
  • OR cpe:/a:squid:squid:2.5_stable9:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:squid-cache:squid:2.4:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.5.stable5:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.5.stable7:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.5.stable9:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.4.stable1:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.4.stable2:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.4.stable3:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.4.stable4:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.4.stable6:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.5.stable4:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.5.stable3:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.5.stable1:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.4.stable7:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.5.stable2:*:*:*:*:*:*:*
  • OR cpe:/a:squid-cache:squid:2.5.stable8:*:*:*:*:*:*:*
  • AND
  • cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20050446
    V
    		CVE-2005-0446
    2015-11-16
    oval:org.mitre.oval:def:11264
    V
    		Squid 2.5.STABLE8 and earlier allows remote attackers to cause a denial of service (crash) via certain DNS responses regarding (1) Fully Qualified Domain Names (FQDN) in fqdncache.c or (2) IP addresses in ipcache.c, which trigger an assertion failure.
    2013-04-29
    oval:com.redhat.rhsa:def:20050201
    P
    		RHSA-2005:201: squid security update (Moderate)
    2005-03-16
    oval:com.redhat.rhsa:def:20050173
    P
    		RHSA-2005:173: squid security update (Moderate)
    2005-03-03
    oval:org.debian:def:688
    V
    		missing input sanitising
    2005-02-23
    BACK
    squid squid 2.0.patch1
    squid squid 2.0.patch2
    squid squid 2.0.pre1
    squid squid 2.0.release
    squid squid 2.0_patch2
    squid squid 2.1.patch1
    squid squid 2.1.patch2
    squid squid 2.1.pre1
    squid squid 2.1.pre3
    squid squid 2.1.pre4
    squid squid 2.1.release
    squid squid 2.1_patch2
    squid squid 2.2.devel3
    squid squid 2.2.devel4
    squid squid 2.2.pre1
    squid squid 2.2.pre2
    squid squid 2.2.stable1
    squid squid 2.2.stable2
    squid squid 2.2.stable3
    squid squid 2.2.stable4
    squid squid 2.2.stable5
    squid squid 2.3.devel2
    squid squid 2.3.devel3
    squid squid 2.3.stable1
    squid squid 2.3.stable2
    squid squid 2.3.stable3
    squid squid 2.3.stable4
    squid squid 2.3.stable5
    squid squid 2.3_.stable4
    squid squid 2.3_.stable5
    squid squid 2.3_stable5
    squid squid 2.4
    squid squid 2.4.stable1
    squid squid 2.4.stable2
    squid squid 2.4.stable3
    squid squid 2.4.stable4
    squid squid 2.4.stable6
    squid squid 2.4.stable7
    squid squid 2.4_.stable2
    squid squid 2.4_.stable6
    squid squid 2.4_.stable7
    squid squid 2.4_stable7
    squid squid 2.5.6
    squid squid 2.5.stable1
    squid squid 2.5.stable2
    squid squid 2.5.stable3
    squid squid 2.5.stable4
    squid squid 2.5.stable5
    squid squid 2.5.stable6
    squid squid 2.5.stable7
    squid squid 2.5.stable8
    squid squid 2.5_.stable1
    squid squid 2.5_.stable3
    squid squid 2.5_.stable4
    squid squid 2.5_.stable5
    squid squid 2.5_.stable6
    squid squid 2.5_stable3
    squid squid 2.5_stable4
    squid squid 2.5_stable9
    squid-cache squid 2.4
    squid-cache squid 2.5.stable5
    squid-cache squid 2.5.stable7
    squid-cache squid 2.5.stable9
    squid-cache squid 2.4.stable1
    squid-cache squid 2.4.stable2
    squid-cache squid 2.4.stable3
    squid-cache squid 2.4.stable4
    squid-cache squid 2.4.stable6
    squid-cache squid 2.5.stable4
    squid-cache squid 2.5.stable3
    squid-cache squid 2.5.stable1
    squid-cache squid 2.4.stable7
    squid-cache squid 2.5.stable2
    squid-cache squid 2.5.stable8
    debian debian linux 3.0
    gentoo linux *
    suse linux enterprise server 8
    mandrakesoft mandrake linux corporate server 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    suse suse linux 8.2
    suse suse linux 9.0
    mandrakesoft mandrake linux 9.2
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    mandrakesoft mandrake linux 10.0
    suse suse linux 9.1
    redhat enterprise linux 3
    suse suse linux 9.2
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux corporate server 3.0
    mandrakesoft mandrake linux 9.2
    mandrakesoft mandrake linux 10.0
    mandrakesoft mandrake linux corporate server 2.1