Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

Unknown

Privileges Required

Unknown

Attack Vector

Unknown

0

CVE-2011-3205

Disclosure Date: September 06, 2011 •

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

None

Impact Score:

Unknown

Exploitability Score:

Unknown

Vector:

Attack Vector (AV):

Unknown

Attack Complexity (AC):

Unknown

Privileges Required (PR):

Unknown

User Interaction (UI):

Unknown

Scope (S):

Unknown

Confidentiality (C):

Unknown

Integrity (I):

Unknown

Availability (A):

Unknown

Vendors

squid-cache

Products

References

Canonical

CVE-2011-3205 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3205)

BID-49356 (http://www.securityfocus.com/bid/49356)

Advisory

http://www.redhat.com/support/errata/RHSA-2011-1293.html

SECUNIA-46029 (http://secunia.com/advisories/46029)

SECUNIA-45906 (http://secunia.com/advisories/45906)

FEDORA-2011-11854 (http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html)

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html

http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html

SECTRACK-1025981 (http://securitytracker.com/id?1025981)

http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch

http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch

http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch

SECUNIA-45965 (http://secunia.com/advisories/45965)

SECUNIA-45805 (http://secunia.com/advisories/45805)

DSA-2304 (http://www.debian.org/security/2011/dsa-2304)

[oss-security] 20110830 Re: CVE-request(?): squid: buffer overflow in Gopher reply parser (http://openwall.com/lists/oss-security/2011/08/30/8)

http://www.squid-cache.org/Advisories/SQUID-2011_3.txt

http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html

[oss-security] 20110829 CVE-request(?): squid: buffer overflow in Gopher reply parser (http://openwall.com/lists/oss-security/2011/08/29/2)

https://bugzilla.redhat.com/show_bug.cgi?id=734583

[oss-security] 20110830 Re: CVE-request(?): squid: buffer overflow in Gopher reply parser (http://openwall.com/lists/oss-security/2011/08/30/4)

http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html

OSVDB-74847 (http://www.osvdb.org/74847)

SECUNIA-45920 (http://secunia.com/advisories/45920)

http://www.mandriva.com/security/advisories?name=MDVSA-2011:150

Rapid7

Technical Analysis