NVD

Id
45093  
Name
CVE-2012-3501  
Description
The squidclamav_check_preview_handler function in squidclamav.c in SquidClamav 5.x before 5.8 and 6.x before 6.7 passes an unescaped URL to a system command call, which allows remote attackers to cause a denial of service (daemon crash) via a URL with certain characters, as demonstrated using %0D or %0A.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2012-08-25  
Modified Date
2012-08-27  
Seq
2012-3501  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
226221 45093 CVE-2012-3501 http://freecode.com/projects/squidclamav/releases/346722  View
226222 45093 CVE-2012-3501 http://squidclamav.darold.net/news.html  View
226223 45093 CVE-2012-3501 [oss-security] 20120816 CVE Request: SquidClamav insufficient escaping flaws  View
226224 45093 CVE-2012-3501 [oss-security] 20120816 Re: CVE Request: SquidClamav insufficient escaping flaws  View
226225 45093 CVE-2012-3501 54663  View
226226 45093 CVE-2012-3501 https://bugs.gentoo.org/show_bug.cgi?id=428778  View
226227 45093 CVE-2012-3501 https://github.com/darold/squidclamav/commit/80f74451f628264d1d9a1f1c0bbcebc932ba5e00  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
28172 JVNDB-2012-003879 SquidClamav の squidclamav.c におけるサービス運用妨害 (デーモンクラッシュ) の脆弱性 SquidClamav の squidclamav.c 内の squidclamav_check_preview_handler 関数は、システムコマンドの呼び出しにエスケープされない URL を渡すため、サービス運用妨害 (デーモンクラッシュ) 状態となる脆弱性が存在します。 CVE-2012-3501 56739 CVE-2012-3501 45093 5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003879.html 2012-08-25 2012-08-28 View