CVE-2004-0918 json
The asn_parse_header function (asn1.c) in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a d…
published 2004-10-21 22 y ago modified 2026-06-16 4 mo ago also EUVD-2004-0916
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 15.8%
- EPSS 15.8% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
The asn_parse_header function (asn1.c) in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a denial of service (server restart) via certain SNMP packets with negative length fields that trigger a memory allocation error.
Patch / fix
- squid Debian 14, Debian 13, Debian 12 2.5.7
debian advisories DEBIAN-CVE-2004-0918
- squid RHEL 3 7:2.5.STABLE3-6.3E.2
red hat advisories RHSA-2004:591
- redhat.com/support/errata/RHSA-2004-591.html advisory
- securityfocus.com/bid/11385 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2004-0918 updated
Squid SNMP DoS
-
Red Hat Desktop version 3 squid 2.5.STABLE3-6.3E.2 Red Hat Enterprise Linux AS version 3 squid 2.5.STABLE3-6.3E.2 Red Hat Enterprise Linux ES version 3 squid 2.5.STABLE3-6.3E.2 Red Hat Enterprise Linux WS version 3 squid 2.5.STABLE3-6.3E.2fixed: vendor fix RHSA-2004:591
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
15.83% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-399 Resource Management Errors
References
-
redhat.com
/support/errata/RHSA-2004-591.html
vendor-advisory, patch
-
securityfocus.com
/bid/11385
vdb-entry, patch, vendor-advisory
-
distro.conectiva.com.br
/atualizacoes/?id=a&anuncio=000923
vendor-advisory
-
fedoranews.org
/updates/FEDORA--.shtml
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2008-07/msg00001.html
vendor-advisory
-
redhat.com
/archives/fedora-package-announce/2008-July/msg00122.html
vendor-advisory
-
marc.info
/?l=bugtraq&m=109913064629327&w=2
vendor-advisory
-
gentoo.org
/security/en/glsa/glsa-200410-15.xml
vendor-advisory
-
vupen.com
/english/advisories/2008/1969/references
vdb-entry, vendor-advisory
-
secunia.com
/advisories/30967
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/30914
third-party-advisory, vendor-advisory
-
idefense.com
/application/poi/display?id=152&type=vulnerabilities&flashstatus=false
third-party-advisory
- squid-cache.org /Advisories/SQUID-2004_3.txt
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10931
vdb-entry, signature
-
exchange.xforce.ibmcloud.com
/vulnerabilities/17688
vdb-entry
- squid-cache.org /Advisories/SQUID-2008_1.txt
Sources
- CVE List CVE-2004-0918
- NVD CVE-2004-0918
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Fix old broken CPEs.