CVE-2014-0128 Denial of service in n/a

Medium 5.0 Published 14 Apr 2014 Updated 6 Aug 2024

Remote attackers can cause a denial of service in Squid proxy servers via crafted range requests when SSL-Bump is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-0128?

CVE-2014-0128 is a medium-severity denial of service vulnerability in Opensuse Opensuse, published on 14 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

Weakness: CWE-20

Which versions are affected by CVE-2014-0128?

It affects 2 products.

Linux distribution packages (4)

`squid` Red Hat:enterprise_linux:6::server	All versions	`7:3.1.10-20.el6_5.3`
`squid-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`7:3.1.10-20.el6_5.3`
`squid` Red Hat:enterprise_linux:6::workstation	All versions	`7:3.1.10-20.el6_5.3`
`squid-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`7:3.1.10-20.el6_5.3`

Products include Opensuse Opensuse, Squid-Cache Squid.

How do I fix CVE-2014-0128?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2014-0128 being exploited?

There is no known exploitation of CVE-2014-0128 in the wild and no public exploit code.

All Opensuse Opensuse vulnerabilities

Sources

Also known as GHSA-m2w9-x6qf-9vf9, MGASA-2014-0168, MGASA-2014-0192, RHSA-2014:0597, UBUNTU-CVE-2014-0128.