Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and the observed behavior is consistent with a squid.conf file that was (perhaps inadvertently) designed to allow access based on a req_header Host acl regex that matches www.uol.com.br
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Squid | Squid-cache | 3.1.9 (including) | 3.1.9 (including) |
| Squid | Ubuntu | hardy | * |
| Squid | Ubuntu | lucid | * |
| Squid | Ubuntu | natty | * |
| Squid | Ubuntu | oneiric | * |
| Squid3 | Ubuntu | devel | * |
| Squid3 | Ubuntu | hardy | * |
| Squid3 | Ubuntu | lucid | * |
| Squid3 | Ubuntu | natty | * |
| Squid3 | Ubuntu | oneiric | * |
| Squid3 | Ubuntu | precise | * |
| Squid3 | Ubuntu | quantal | * |
| Squid3 | Ubuntu | raring | * |