CVE

CVE-2002-0067

Date: (C)2002-03-08   (M)2023-12-22

Squid 2.4 STABLE3 and earlier does not properly disable HTCP, even when "htcp_port 0" is specified in squid.conf, which could allow remote attackers to bypass intended access restrictions.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 7.5
Exploit Score: 10.0
Impact Score: 6.4
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL

Reference:

http://marc.info/?l=bugtraq&m=101431040422095&w=2

http://marc.info/?l=bugtraq&m=101443252627021&w=2

BID-4150

OSVDB-5379

CLA-2002:464

CSSA-2002-SCO.7

FreeBSD-SA-02:12

MDKSA-2002:016

RHSA-2002:029

http://www.squid-cache.org/Versions/v2/2.4/bugs/

squid-htcp-enabled(8261)