Signature Detail

SSL: Squid SSL-Bump Denial of Service

This signature detects attempts to exploit a known vulnerability against Squid. The vulnerability is due to integer overflow and input validation errors in Squid when processing TLS messages. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted Client or Server Hello message, which when parsed triggers the vulnerability; the vulnerable application consumes an uncontrolled amount of resource and does not respond to requests, leading to a denial-of-service condition.