CVE-2005-0194

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000923Patch
http://fedoranews.org/updates/FEDORA--.shtml
http://marc.info/?l=bugtraq&m=110901183320453&w=2
http://www.debian.org/security/2005/dsa-667Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/260421Patch, Third Party Advisory, US Government Resource
http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_aclsPatch
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-empty_acls.patchPatch
http://www.squid-cache.org/bugs/show_bug.cgi?id=1166Vendor Advisory
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000923Patch
http://fedoranews.org/updates/FEDORA--.shtml
http://marc.info/?l=bugtraq&m=110901183320453&w=2
http://www.debian.org/security/2005/dsa-667Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/260421Patch, Third Party Advisory, US Government Resource
http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_aclsPatch
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-empty_acls.patchPatch
http://www.squid-cache.org/bugs/show_bug.cgi?id=1166Vendor Advisory

Timeline

Published: May 2, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-01955.0Cisco IOS 12.0S through 12.3YH allows remote attackers to cause a denial of service (device restart) via a crafted IPv6 packet.CVE-2005-01965.0Cisco IOS 12.0 through 12.3YL, with BGP enabled and running the bgp log-neighbor-changes command, allows remote attackers to cause a denial CVE-2005-01976.1Cisco IOS 12.1T, 12.2, 12.2T, 12.3 and 12.3T, with Multi Protocol Label Switching (MPLS) installed but disabled, allows remote attackers to CVE-2005-01987.5A logic error in the CRAM-MD5 code for the University of Washington IMAP (UW-IMAP) server, when Challenge-Response Authentication Mechanism CVE-2005-01999.8Integer underflow in the Lists_MakeMask() function in lists.c in ngIRCd before 0.8.2 allows remote attackers to cause a denial of service (a CVE-2005-02007.5TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to CVE-2005-02012.1D-BUS (dbus) before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen o CVE-2005-02025.0Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbi CVE-2005-02042.1Linux kernel before 2.6.9, when running on the AMD64 and Intel EM64T architectures, allows local users to write to privileged IO ports via t CVE-2005-02054.6KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a d CVE-2005-02067.5The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux d CVE-2005-02072.1Unknown vulnerability in Linux kernel 2.4.x, 2.5.x, and 2.6.x allows NFS clients to cause a denial of service via O_DIRECT.