>> Squid FTP URI Handling and "external_acl" Remote Denial of Service Vulnerabilities
Title : Squid FTP URI Handling and "external_acl" Remote Denial of Service Vulnerabilities VUPEN ID : VUPEN/ADV-2007-0199 CVE ID : CVE-2007-0247 - CVE-2007-0248
Rated as : Low Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2007-01-16
Technical Description
Two vulnerabilities have been identified in Squid, which could be exploited by attackers to cause a denial of service.
The first issue is due to errors in the "ftpListingFinish()" and "ftpHtmlifyListEntry()" [ftp.c] functions when processing certain FTP URIs, which could be exploited by attackers to crash a vulnerable proxy via a malicious URL.
The second issue is due to an infinite loop in "aclMatchExternal()" and "externalAclLookup()" [external_acl.c] when the proxy is under high load, which could be exploited to cause a denial of service.
