NVD

Id
18615  
Name
CVE-2016-2390  
Description
The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2016-04-19  
Modified Date
2016-11-28  
Seq
2016-2390  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
103204 18615 CVE-2016-2390 http://bugs.squid-cache.org/show_bug.cgi?id=4437  View
103205 18615 CVE-2016-2390 SUSE-SU-2016:1996  View
103206 18615 CVE-2016-2390 SUSE-SU-2016:2089  View
103207 18615 CVE-2016-2390 [squid-announce] 20160216 Squid 3.5.14 is available  View
103208 18615 CVE-2016-2390 [squid-announce] 20160216 Squid 4.0.6 beta is available  View
103209 18615 CVE-2016-2390 1035045  View
103210 18615 CVE-2016-2390 http://www.squid-cache.org/Advisories/SQUID-2016_1.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1539 JVNDB-2016-002312 Squid の FwdState.cc の FwdState::connectedToPeer メソッドにおけるサービス運用妨害 (DoS) の脆弱性 Squid の FwdState.cc の FwdState::connectedToPeer メソッドは、--with-openssl オプションでビルドされた場合、SSL ハンドシェイクエラーを適切に処理しないため、サービス運用妨害 (アプリケーションクラッシュ) 状態にされる脆弱性が存在します。 CVE-2016-2390 88896 CVE-2016-2390 18615 4.3 5.9 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002312.html 2016-02-16 2016-04-27 View