Henrik Nordstrom

**Name of the Vulnerable Software and Affected Versions** Squid versions 2.5 and earlier **Description** The issue allows remote authenticated users to bypass username-based Access Control Lists (ACLs) by using a username with a space at the beginning or end. This is possible because the LDAP server ignores such spaces in usernames. **Recommendations** For Squid versions 2.5 and earlier, consider updating to a version where this issue is fixed, or as a temporary workaround, restrict the use of usernames with leading or trailing spaces to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Squid versions prior to 2.6.STABLE7 **Description** The issue concerns multiple vulnerabilities in the Squid package that can lead to a disruption in the availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service. Specifically, the `ftpListingFinish` and `ftpHtmlifyListEntry` functions in `squid/src/ftp.c` are affected, allowing remote FTP servers to cause a core dump via crafted FTP directory listing responses. **Recommendations** For Squid versions prior to 2.6.STABLE7, update to version 2.6.STABLE7 or later to resolve the issue. As a temporary workaround, consider restricting access to the `ftpListingFinish` and `ftpHtmlifyListEntry` functions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Squid versions prior to 2.6.STABLE7 **Description** The issue allows remote attackers to cause a denial of service, potentially leading to a disruption in the availability of protected information. This can be achieved by overloading the external acl queue, which triggers an infinite loop in the `aclMatchExternal` function. The exploitation of this issue can be done remotely. **Recommendations** For Squid versions prior to 2.6.STABLE7, update to version 2.6.STABLE7 or later to resolve the issue. As a temporary workaround, consider restricting access to the `aclMatchExternal` function to minimize the risk of exploitation.