According to the Squid Proxy Cache Security Update Advisory
SQUID-2005:3,
The WCCP recvfrom() call accepts more data than will fit in
the allocated buffer. An attacker may send a larger-than-normal
WCCP message to Squid and overflow this buffer.
Severity:
The bug is important because it allows remote attackers to crash
Squid, causing a disription in service. However, the bug is
exploitable only if you have configured Squid to send WCCP messages
to, and expect WCCP replies from, a router.
Sites that do not use WCCP are not vulnerable.
Note that while the default configuration of the FreeBSD squid port
enables WCCP support in general, the default configuration
supplied does not actually configure squid to send and receive WCCP
messages.