Vulnerability Name:

CVE-2006-0046 (CCN-24640)

Assigned:2005-12-28
Published:2006-02-09
Updated:2017-07-20
Summary:squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing / (forward slashes), which might produce inefficient regular expressions.
CVSS v3 Severity:3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
5.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: CCN
Type: Adzapper Web page
CVS log for /home/cameron/@/adzapper.sf/html

Source: CONFIRM
Type: UNKNOWN
http://adzapper.sourceforge.net/cvslog.html

Source: MISC
Type: UNKNOWN
http://bugs.debian.org/cgi-bin/bugreport.cgi/squid_redirect.diff?bug=350308;msg=5;att=1

Source: MISC
Type: UNKNOWN
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350308

Source: MITRE
Type: CNA
CVE-2006-0046

Source: CCN
Type: SA18771
Adzapper URL Handling Denial of Service Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
18771

Source: SECUNIA
Type: Patch, Vendor Advisory
18777

Source: DEBIAN
Type: Patch, Vendor Advisory
DSA-966

Source: DEBIAN
Type: DSA-966
adzapper -- denial of service

Source: OSVDB
Type: UNKNOWN
22900

Source: CCN
Type: OSVDB ID: 22900
Ad Zapping With Squid squid_redirect Crafted URL DoS

Source: BID
Type: UNKNOWN
16558

Source: CCN
Type: BID-16558
Adzapper Squid_Redirect URI Handling Remote Denial of Service Vulnerability

Source: VUPEN
Type: UNKNOWN
ADV-2006-0491

Source: XF
Type: UNKNOWN
adzapper-squid-redirect-dos(24640)

Source: XF
Type: UNKNOWN
adzapper-squid-redirect-dos(24640)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cameron_simpson:adzapper:2006-01-01:*:*:*:*:*:*:*
  • OR cpe:/a:cameron_simpson:adzapper:2006-01-05:*:*:*:*:*:*:*
  • OR cpe:/a:cameron_simpson:adzapper:2006-01-07:*:*:*:*:*:*:*
  • OR cpe:/a:cameron_simpson:adzapper:2006-01-14:*:*:*:*:*:*:*
  • OR cpe:/a:cameron_simpson:adzapper:2006-01-15:*:*:*:*:*:*:*
  • OR cpe:/a:cameron_simpson:adzapper:2006-01-23:*:*:*:*:*:*:*
  • OR cpe:/a:cameron_simpson:adzapper:2006-01-24:*:*:*:*:*:*:*
  • OR cpe:/a:cameron_simpson:adzapper:2006-01-25:*:*:*:*:*:*:*
  • OR cpe:/a:cameron_simpson:adzapper:2006-01-28:*:*:*:*:*:*:*
  • OR cpe:/a:cameron_simpson:adzapper:2006-01-29:*:*:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:cameron_simpson:adzapper:2006-01-01:*:*:*:*:*:*:*
  • AND
  • cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.debian:def:966
    V
    denial of service
    2006-02-09
    BACK
    cameron_simpson adzapper 2006-01-01
    cameron_simpson adzapper 2006-01-05
    cameron_simpson adzapper 2006-01-07
    cameron_simpson adzapper 2006-01-14
    cameron_simpson adzapper 2006-01-15
    cameron_simpson adzapper 2006-01-23
    cameron_simpson adzapper 2006-01-24
    cameron_simpson adzapper 2006-01-25
    cameron_simpson adzapper 2006-01-28
    cameron_simpson adzapper 2006-01-29
    cameron_simpson adzapper 2006-01-01
    debian debian linux 3.1