Date: Tue, 16 Sep 2014 09:16:35 +0200 From: Sebastian Krahmer <krahmer@...e.de> To: cve-assign@...re.org Cc: oss-security@...ts.openwall.com Subject: Re: CVE-Request: squid pinger remote DoS On Tue, Sep 16, 2014 at 02:56:30AM -0400, cve-assign@...re.org wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > I made a fix for squid 3.4.6 and request a CVE > > > https://bugzilla.novell.com/show_bug.cgi?id=891268 > > Regardless of the "what happens to squid itself" answer, is it known > that the crash has a security impact? This message seemed to conclude Well, in any case whether its restarted or not, it should be fixed. For me its a remote DoS, its your decision if it qualifies for a CVE. The indexing bug is the "real issue" whereas the others IMHO qualify as hardening and only produce junk-packets or fake logs if exploited. Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer@...e.de - SuSE Security Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.