CVE-2010-0639

Publication date 15 February 2010

Last updated 24 July 2024

Ubuntu priority

The htcpHandleTstRequest function in htcp.c in Squid 2.x before 2.6.STABLE24 and 2.7 before 2.7.STABLE8, and htcp.cc in 3.0 before 3.0.STABLE24, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets to the HTCP port.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
squid	11.10 oneiric	Fixed 2.7.STABLE7-1ubuntu6
	11.04 natty	Fixed 2.7.STABLE7-1ubuntu6
	10.10 maverick	Fixed 2.7.STABLE7-1ubuntu6
	10.04 LTS lucid	Fixed 2.7.STABLE7-1ubuntu6
	9.10 karmic	Fixed 2.7.STABLE6-2ubuntu2.2
	9.04 jaunty	Fixed 2.7.STABLE3-4.1ubuntu1.2
	8.10 intrepid	Fixed 2.7.STABLE3-1ubuntu2.3
	8.04 LTS hardy	Fixed 2.6.18-1ubuntu3.2
	6.06 LTS dapper	Not affected
squid3	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Fixed 3.0.STABLE19-1ubuntu0.2
	9.10 karmic	Ignored
	9.04 jaunty	Ignored
	8.10 intrepid	Ignored
	8.04 LTS hardy	Ignored
	6.06 LTS dapper	Not in release

Notes

mdeslaur

code not present in dapper (It's actually the htcpHandleClr function that is being patched here)

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
squid	Upstream: http://www.squid-cache.org/Versions/v2/2.7/changesets/12600.patch
squid3	Upstream: http://www.squid-cache.org/Versions/v3/3.0/changesets/3.0-ADV-2010_2.patch

References

Related Ubuntu Security Notices (USN)