Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in squid
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in squid
ID: MDKSA-2005:034
Distribution: Mandrake
Plattformen: Mandrake Corporate Server 2.1, Mandrake 9.2, Mandrake 10.0, Mandrake 10.1, Mandrake Corporate Server 3.0
Datum: Fr, 11. Februar 2005, 12:00
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0173
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0175
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0211
http://www.squid-cache.org/Advisories/SQUID-2005_3.txt
Applikationen: Squid

Originalnachricht

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandrakelinux Security Update Advisory
_______________________________________________________________________

Package name: squid
Advisory ID: MDKSA-2005:034
Date: February 10th, 2005

Affected versions: 10.0, 10.1, 9.2, Corporate 3.0,
Corporate Server 2.1
______________________________________________________________________

Problem Description:

More vulnerabilities were discovered in the squid server:

The LDAP handling of search filters was inadequate which could be
abused to allow logins using severial variants of a single login name,
possibly bypassing explicit access controls (CAN-2005-0173).

Minor problems in the HTTP header parsing code that could be used for
cache poisoning (CAN-2005-0174 and CAN-2005-0175).

A buffer overflow in the WCCP handling code allowed remote attackers
to cause a Denial of Service and could potentially allow for the
execution of arbitrary code by using a long WCCP packet.

The updated packages have been patched to prevent these problems.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0173
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0175
http://www.squid-cache.org/Advisories/SQUID-2005_3.txt
______________________________________________________________________

Updated Packages:

Mandrakelinux 10.0:
656b659ee9ba2c1a08e24d1187a2c29f
10.0/RPMS/squid-2.5.STABLE4-2.4.100mdk.i586.rpm
d856951204f2d02932e7bb413bb31bfa
10.0/SRPMS/squid-2.5.STABLE4-2.4.100mdk.src.rpm

Mandrakelinux 10.0/AMD64:
432ea3eabd02f1f3b18919b23a3f19fe
amd64/10.0/RPMS/squid-2.5.STABLE4-2.4.100mdk.amd64.rpm
d856951204f2d02932e7bb413bb31bfa
amd64/10.0/SRPMS/squid-2.5.STABLE4-2.4.100mdk.src.rpm

Mandrakelinux 10.1:
a5bf0588457cd842d2326f647ebcbc25
10.1/RPMS/squid-2.5.STABLE6-2.3.101mdk.i586.rpm
b726f35ab93d4a12576a7923e374e5bf
10.1/SRPMS/squid-2.5.STABLE6-2.3.101mdk.src.rpm

Mandrakelinux 10.1/X86_64:
96e84ddeb61f432b7358344da7608f25
x86_64/10.1/RPMS/squid-2.5.STABLE6-2.3.101mdk.x86_64.rpm
b726f35ab93d4a12576a7923e374e5bf
x86_64/10.1/SRPMS/squid-2.5.STABLE6-2.3.101mdk.src.rpm

Corporate Server 2.1:
50c44984c30f4c8e0db630da66411c70
corporate/2.1/RPMS/squid-2.4.STABLE7-2.4.C21mdk.i586.rpm
d706be0b04a5ac2e5b28b5b151181bda
corporate/2.1/SRPMS/squid-2.4.STABLE7-2.4.C21mdk.src.rpm

Corporate Server 2.1/X86_64:
4cd111cf43876cc401eccfc49b48148c
x86_64/corporate/2.1/RPMS/squid-2.4.STABLE7-2.4.C21mdk.x86_64.rpm
d706be0b04a5ac2e5b28b5b151181bda
x86_64/corporate/2.1/SRPMS/squid-2.4.STABLE7-2.4.C21mdk.src.rpm

Corporate 3.0:
be661ea6526f37cf0efdb097319a2a46
corporate/3.0/RPMS/squid-2.5.STABLE4-2.4.C30mdk.i586.rpm
8fd70e360e772d30e8668000a6954a1d
corporate/3.0/SRPMS/squid-2.5.STABLE4-2.4.C30mdk.src.rpm

Corporate 3.0/X86_64:
13a4a4ac0b02deb4366482e3f2317b22
x86_64/corporate/3.0/RPMS/squid-2.5.STABLE4-2.4.C30mdk.x86_64.rpm
8fd70e360e772d30e8668000a6954a1d
x86_64/corporate/3.0/SRPMS/squid-2.5.STABLE4-2.4.C30mdk.src.rpm

Mandrakelinux 9.2:
c421d3df715cefb0a97995269f16e931
9.2/RPMS/squid-2.5.STABLE3-3.6.92mdk.i586.rpm
1fd8fdf79dbd6f647d00bea37be5400b
9.2/SRPMS/squid-2.5.STABLE3-3.6.92mdk.src.rpm

Mandrakelinux 9.2/AMD64:
21d4c2e94050161a6192e63304852ec7
amd64/9.2/RPMS/squid-2.5.STABLE3-3.6.92mdk.amd64.rpm
1fd8fdf79dbd6f647d00bea37be5400b
amd64/9.2/SRPMS/squid-2.5.STABLE3-3.6.92mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandrakesoft for security. You can obtain
the GPG public key of the Mandrakelinux Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandrakelinux at:

http://www.mandrakesoft.com/security/advisories

If you want to report vulnerabilities, please contact

security_linux-mandrake.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFCC/SamqjQ0CJFipgRAhPvAKCDJG8AXX5DhPnTfg2YhLRt0f0QiwCeLPZ8
7fQZTNd/RqzupNESMbqf0YM=
=4Cgu
-----END PGP SIGNATURE-----


____________________________________________________
Want to buy your Pack or Services from MandrakeSoft?
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung