[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 16 Sep 2014 09:16:35 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: cve-assign@...re.org
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE-Request: squid pinger remote DoS
On Tue, Sep 16, 2014 at 02:56:30AM -0400, cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> > I made a fix for squid 3.4.6 and request a CVE
>
> > https://bugzilla.novell.com/show_bug.cgi?id=891268
>
> Regardless of the "what happens to squid itself" answer, is it known
> that the crash has a security impact? This message seemed to conclude
Well, in any case whether its restarted or not, it should be fixed.
For me its a remote DoS, its your decision if it qualifies for a CVE.
The indexing bug is the "real issue" whereas the others IMHO qualify
as hardening and only produce junk-packets or fake logs if exploited.
Sebastian
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
