Vulnerability in Squid
CVE-2005-0194
Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.
EPSS: 0.051 (91.5th percentile) — read the EPSS interpretation.
Affected products
- Squid — versions 2.0.patch1, 2.0.patch2, 2.0.pre1
- N/a — versions n/a
References
- cve@mitre.org (vendor-advisory, Patch, x_refsource_CONECTIVA)
- cve@mitre.org (x_refsource_CONFIRM, Patch)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (x_refsource_CONFIRM, Patch)
- cve@mitre.org (x_refsource_FEDORA, vendor-advisory)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (vendor-advisory, Patch, x_refsource_DEBIAN, Vendor Advisory)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, Patch, Third Party Advisory, third-party-advisory)