Message-Id: <E1Kn5ne-0007FG-D3@klecker.debian.org>
Date: Tue, 07 Oct 2008 06:12:02 +0000
From: Devin Carraway <devin@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA-1646-1] New squid packages fix array bounds check

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1646-1                  security@...ian.org
http://www.debian.org/security/                           Devin Carraway
October 07, 2008                      http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : squid
Vulnerability  : array bounds check
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2008-1612

A weakness has been discovered in squid, a caching proxy server.  The
flaw was introduced upstream in response to CVE-2007-6239, and
announced by Debian in DSA-1482-1.  The flaw involves an
over-aggressive bounds check on an array resize, and could be
exploited by an authorized client to induce a denial of service
condition against squid.

For the stable distribution (etch), these problems have been fixed in
version 2.6.5-6etch2.

We recommend that you upgrade your squid packages.


Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5.orig.tar.gz
    Size/MD5 checksum:  1636886 26cc918028340dc8ceb9c0c4b988d717
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2.diff.gz
    Size/MD5 checksum:   273482 a50f26f9efdb5a4cecb924079a7acfb9
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2.dsc
    Size/MD5 checksum:      669 b1726dce2c7eea1e010906ea38bf072c

Architecture independent packages:

  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6.5-6etch2_all.deb
    Size/MD5 checksum:   437244 8bc777de8a4c48c8bf97b549f623c3b4

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch2_alpha.deb
    Size/MD5 checksum:    88358 85c2aa241e702ccbf2b628adeacb31ca
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2_alpha.deb
    Size/MD5 checksum:   793566 ffdb43d648ad1bf20bf7abe02bdf02c3
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch2_alpha.deb
    Size/MD5 checksum:   119714 dce5baad9332f9e854f193770798025c

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch2_amd64.deb
    Size/MD5 checksum:    86296 6f3e9c710fd34f6e6dc73f59dd08305f
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch2_amd64.deb
    Size/MD5 checksum:   116682 a5cd8cc313c0ac1b029465ea20e4f545
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2_amd64.deb
    Size/MD5 checksum:   708968 e8742c13712128d60a771644ebba83c4

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch2_arm.deb
    Size/MD5 checksum:    86138 3dacde2e043c0569b3d91967cbd8a12a
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2_arm.deb
    Size/MD5 checksum:   676532 82a513ebd7efa71b7c4d433c11a92e21
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch2_arm.deb
    Size/MD5 checksum:   116058 a1f1c3e60860d99abc8a357756b8286c

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2_hppa.deb
    Size/MD5 checksum:   748436 f367be1a2654ba16ea5ffb8cd9402d0d
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch2_hppa.deb
    Size/MD5 checksum:    88006 bb51d372ee4bfefc50ad14dd80a3fd1e
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch2_hppa.deb
    Size/MD5 checksum:   118664 73d47d6e71b0c587b5ee47c050e73fed

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2_i386.deb
    Size/MD5 checksum:   655102 974ebf7aa186c3bcad04db331eb1f9ef
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch2_i386.deb
    Size/MD5 checksum:    86032 8b76b6bef4d98138f0257e2facf390e3
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch2_i386.deb
    Size/MD5 checksum:   116484 1bf5155048c9f99ad0550a948dc7ec54

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch2_ia64.deb
    Size/MD5 checksum:   124294 46d7deb973420ec5e1fcf0d285b9c0fd
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2_ia64.deb
    Size/MD5 checksum:  1067214 28910fa078f1877aa9cc481e2601978f
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch2_ia64.deb
    Size/MD5 checksum:    91458 9aceade803ca62f2ea942816d0e58a09

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch2_mips.deb
    Size/MD5 checksum:   118250 86ad63f2ec01a03938a831f60c31a376
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch2_mips.deb
    Size/MD5 checksum:    87452 8e70de43fecdd3600edf9717ddc3654e
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2_mips.deb
    Size/MD5 checksum:   739976 606bc3bf5b060bd90ac2527e0eaf8428

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2_mipsel.deb
    Size/MD5 checksum:   747420 47dfe6d5a3f07c07de007b3ffdbf040b
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch2_mipsel.deb
    Size/MD5 checksum:   117306 9142ed1e467e20063cc7dedbcc364738
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch2_mipsel.deb
    Size/MD5 checksum:    87384 4564cc7b0bb576fd5751b4571fb136f3

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch2_powerpc.deb
    Size/MD5 checksum:   116466 b658e55a0d48925469d8bb4da653a354
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch2_powerpc.deb
    Size/MD5 checksum:    86238 e692d6823acdc2334b3479de0458ff31
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2_powerpc.deb
    Size/MD5 checksum:   712486 d979b30de8c28bec9374674aa5a7178f

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch2_s390.deb
    Size/MD5 checksum:   116824 00e3445f2e543533e205028236034fb3
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch2_s390.deb
    Size/MD5 checksum:    86696 4d6587126afef9e41f2a2f66234f8d65
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2_s390.deb
    Size/MD5 checksum:   711996 476e518c2abe6808d126bcd251b6029b

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch2_sparc.deb
    Size/MD5 checksum:   116054 3f961d32524fdfd4ce03bfded0d8d4e0
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch2_sparc.deb
    Size/MD5 checksum:    86500 fad99b5e831a0fc3d59d1b2abb187a10
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch2_sparc.deb
    Size/MD5 checksum:   666098 09e028594df09126c2a5c207c5c8f05c


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFI6vzmU5XKDemr/NIRAkwtAJ4pNXgkFw+SCKR852q/V7W5Kd0aiACcCKt3
IJhWH7dsXZOeomJG9S2Ex94=
=GUv/
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists