Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 14 Nov 2011 17:42:24 -0500 (EST)
From: "Steven M. Christey" <>
Subject: Re: CVE Request -- Squid v3.1.16 -- Invalid free by
 processing CNAME DNS record pointing to another CNAME record pointing to an
 empty A-record

In general, an attacker-triggered crash in any type of product that acts 
as an "intermediary" between two parties - such as a proxy, firewall, mail 
server, anti-virus, etc. - is typically counted as a vulnerability for 
CVE, since the crash of the intermediary may cause many active sessions to 
be lost, not just the session for the attacker.  Add repeated crashes and 
you can have a substantive DoS on your hands.

For "passive" intermediaries like IDS and sniffers that just monitor 
traffic, a crash/DoS can lead to loss of visibility/awareness (passing 
traffic doesn't get captured), which can allow an attacker to hide 

- Steve

On Mon, 31 Oct 2011, Henrik Nordström wrote:

> mån 2011-10-31 klockan 14:20 -0600 skrev Kurt Seifried:
>>> Could you allocate a CVE id for this? (cc-ed Henrik and Jiri
>>> for their opinion / comments too, if this should be considered
>>> a security issue or not)
>> I'd say so, in the past we have: CVE-2010-2951, CVE-2010-0639,
>> CVE-2009-3700, etc. Lots of similar ones.
> Agreed.
> Regards
> Henrik

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.