CVE-2005-0095 in Squid
Summary
by MITRE
The WCCP message parsing code in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via malformed WCCP messages with source addresses that are spoofed to reference Squid s home router and invalid WCCP_I_SEE_YOU cache numbers.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/29/2019
The vulnerability described in CVE-2005-0095 represents a critical denial of service flaw within the Squid web proxy software version 2.5.STABLE7 and earlier. This issue specifically targets the Web Cache Communication Protocol message parsing functionality that Squid employs to communicate with WCCP-capable network devices. The vulnerability arises from insufficient input validation mechanisms within the WCCP message processing code, which fails to properly validate the integrity and authenticity of incoming WCCP communications. When malformed WCCP messages are received with spoofed source addresses referencing the Squid server's home router and invalid WCCP_I_SEE_YOU cache numbers, the proxy software becomes susceptible to crashing or becoming unresponsive.
The technical exploitation of this vulnerability occurs through carefully crafted WCCP packets that exploit weaknesses in the message parsing logic. Attackers can construct malicious WCCP messages with spoofed source IP addresses that appear to originate from the Squid server's default gateway or home router, combined with invalid cache identification numbers that fall outside the expected WCCP protocol specifications. This combination of spoofed addresses and malformed cache numbers causes the Squid proxy to process these invalid messages without proper error handling, leading to memory corruption or unexpected state conditions that ultimately result in application crashes. The vulnerability specifically targets the WCCP_I_SEE_YOU message type which is used in the WCCP protocol for cache communication, making it particularly dangerous as it can be triggered by legitimate WCCP traffic that has been manipulated by an attacker.
From an operational perspective, this vulnerability presents a significant risk to organizations relying on Squid proxy servers for network traffic management and caching services. The remote nature of the attack means that malicious actors can exploit this flaw from anywhere on the network without requiring local access or authentication credentials. When successfully exploited, the vulnerability results in complete denial of service for the affected proxy server, disrupting all web traffic passing through that proxy and potentially affecting numerous users or applications dependent on the caching service. The impact extends beyond simple service interruption as the crash can cause the proxy to restart automatically, potentially leading to temporary loss of cached content and increased network latency during recovery periods.
Organizations should implement immediate mitigations to address this vulnerability, including upgrading to Squid versions that contain patches for this specific flaw, typically Squid 2.5.STABLE8 and later releases. Network-level defenses such as firewall rules that filter WCCP traffic or disable WCCP functionality entirely on Squid servers can provide temporary protection while upgrades are being implemented. Additionally, monitoring systems should be configured to detect unusual patterns in WCCP message traffic that might indicate attempted exploitation. The vulnerability aligns with CWE-129, which describes improper validation of input ranges, and can be categorized under ATT&CK technique T1499.002 for network denial of service attacks. Security professionals should also consider implementing intrusion detection systems that can identify and block malformed WCCP packets, as well as conducting regular vulnerability assessments to ensure that all proxy server components remain up to date with security patches.