Vulnerability Details : CVE-2011-3205
Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.
Vulnerability category: OverflowMemory CorruptionDenial of service
Threat overview for CVE-2011-3205
Top countries where our scanners detected CVE-2011-3205
Top open port discovered on systems with this issue
80
IPs affected by CVE-2011-3205 59,710
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2011-3205!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2011-3205
Probability of exploitation activity in the next 30 days: 90.80%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2011-3205
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
References for CVE-2011-3205
-
http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html
[security-announce] SUSE-SU-2011:1019-1: important: Security update for
-
http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch
Patch
-
http://www.squid-cache.org/Advisories/SQUID-2011_3.txt
-
http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch
Patch
-
http://www.debian.org/security/2011/dsa-2304
Debian -- Security Information -- DSA-2304-1 squid3
-
http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch
Patch
-
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
[security-announce] SUSE-SU-2016:2089-1: important: Security update for
-
http://www.securityfocus.com/bid/49356
Squid Proxy Gopher Remote Buffer Overflow Vulnerability
-
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
[security-announce] SUSE-SU-2016:1996-1: important: Security update for
-
https://bugzilla.redhat.com/show_bug.cgi?id=734583
734583 – (CVE-2011-3205) CVE-2011-3205 squid: buffer overflow flaw in Squid's Gopher reply parser (SQUID-2011:3)Patch
-
http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html
[security-announce] openSUSE-SU-2011:1018-1: important: VUL-0: CVE-2011-
-
http://openwall.com/lists/oss-security/2011/08/30/8
oss-security - Re: CVE-request(?): squid: buffer overflow in Gopher reply parser
-
http://www.mandriva.com/security/advisories?name=MDVSA-2011:150
mandriva.com
-
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html
[SECURITY] Fedora 14 Update: squid-3.1.15-1.fc14
-
http://openwall.com/lists/oss-security/2011/08/29/2
oss-security - CVE-request(?): squid: buffer overflow in Gopher reply parser
-
http://www.redhat.com/support/errata/RHSA-2011-1293.html
Support
-
http://securitytracker.com/id?1025981
Squid Gopher Response Memory Corruption Error Lets Remote Users Deny Service - SecurityTracker
-
http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch
Patch
-
http://openwall.com/lists/oss-security/2011/08/30/4
oss-security - Re: CVE-request(?): squid: buffer overflow in Gopher reply parser
Products affected by CVE-2011-3205
- cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable22:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable15:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable14:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable6:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable5:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable21:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable20:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable13:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable12:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable4:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable3:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable2:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable19:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable18:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable11:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable9:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable1:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable17:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable16:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable8:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable7:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable23:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable11:rc1:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable10:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable16:rc1:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable24:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable25:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.18:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.13:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.2.0.10:*:*:*:*:*:*:*