CVE-2008-1612 Denial of service in n/a

Medium 4.3 Published 1 Apr 2008 Updated 7 Aug 2024

Attackers can cause a denial of service in Squid proxy servers by triggering an assertion failure in the arrayShrink function.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2008-1612?

CVE-2008-1612 is a medium-severity denial of service vulnerability in n/a, published on 1 Apr 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17 allows attackers to cause a denial of service (process exit) via unknown vectors that cause an array to shrink to 0 entries, which triggers an assert error. NOTE: this issue is due to an incorrect fix for CVE-2007-6239.

Weakness: CWE-20

Which versions are affected by CVE-2008-1612?

It affects 1 product.

Linux distribution packages (23)

`squid` Red Hat:enterprise_linux:2.1::as	All versions	`7:2.4.STABLE7-1.21as.12`
`squid` Red Hat:enterprise_linux:2.1::aw	All versions	`7:2.4.STABLE7-1.21as.12`
`squid` Red Hat:enterprise_linux:2.1::es	All versions	`7:2.4.STABLE7-1.21as.12`
`squid` Red Hat:enterprise_linux:3::as	All versions	`7:2.5.STABLE3-9.3E`
`squid-debuginfo` Red Hat:enterprise_linux:3::as	All versions	`7:2.5.STABLE3-9.3E`
`squid` Red Hat:enterprise_linux:3::desktop	All versions	`7:2.5.STABLE3-9.3E`
`squid-debuginfo` Red Hat:enterprise_linux:3::desktop	All versions	`7:2.5.STABLE3-9.3E`
`squid` Red Hat:enterprise_linux:3::es	All versions	`7:2.5.STABLE3-9.3E`
`squid-debuginfo` Red Hat:enterprise_linux:3::es	All versions	`7:2.5.STABLE3-9.3E`
`squid` Red Hat:enterprise_linux:3::ws	All versions	`7:2.5.STABLE3-9.3E`
`squid-debuginfo` Red Hat:enterprise_linux:3::ws	All versions	`7:2.5.STABLE3-9.3E`
`squid` Red Hat:enterprise_linux:4::as	All versions	`7:2.5.STABLE14-1.4E.el4_6.2`
`squid-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`7:2.5.STABLE14-1.4E.el4_6.2`
`squid` Red Hat:enterprise_linux:4::desktop	All versions	`7:2.5.STABLE14-1.4E.el4_6.2`
`squid-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`7:2.5.STABLE14-1.4E.el4_6.2`
`squid` Red Hat:enterprise_linux:4::es	All versions	`7:2.5.STABLE14-1.4E.el4_6.2`
`squid-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`7:2.5.STABLE14-1.4E.el4_6.2`
`squid` Red Hat:enterprise_linux:4::ws	All versions	`7:2.5.STABLE14-1.4E.el4_6.2`
`squid-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`7:2.5.STABLE14-1.4E.el4_6.2`
`squid` Red Hat:enterprise_linux:5::client_workstation	All versions	`7:2.6.STABLE6-5.el5_1.3`
`squid-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`7:2.6.STABLE6-5.el5_1.3`
`squid` Red Hat:enterprise_linux:5::server	All versions	`7:2.6.STABLE6-5.el5_1.3`
`squid-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`7:2.6.STABLE6-5.el5_1.3`

Products include Squid Squid.

How do I fix CVE-2008-1612?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2008-1612 being exploited?

There is no known exploitation of CVE-2008-1612 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2008-1612, GHSA-qcwf-4hxx-vx9v, RHSA-2008:0214.