bugtraq - [ MDVSA-2010:187 ] squid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1OyUQC-0003CJ-RS@titan.mandriva.com>
Date: Wed, 22 Sep 2010 20:52:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2010:187 ] squid

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:187
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : squid
 Date    : September 22, 2010
 Affected: 2009.0, 2009.1, 2010.0, 2010.1, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been found and corrected in squid:
 
 The string-comparison functions in String.cci in Squid 3.x before
 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a
 denial of service (NULL pointer dereference and daemon crash) via a
 crafted request (CVE-2010-3072).
 
 Packages for 2008.0 and 2009.0 are provided as of the Extended
 Maintenance Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3072
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.0:
 1639b62ea33f02fd7279621f4b5f1348  2009.0/i586/squid-3.0-22.4mdv2009.0.i586.rpm
 be2fb2e56e983f0240f32df7c63faff5  2009.0/i586/squid-cachemgr-3.0-22.4mdv2009.0.i586.rpm 
 4bb14790230810c4baacacd4c0f42a74  2009.0/SRPMS/squid-3.0-22.4mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 da3a655ce40185905ee4a4a2e13c5f07  2009.0/x86_64/squid-3.0-22.4mdv2009.0.x86_64.rpm
 9ff19b9924ebaae5b01154e22a29da3d  2009.0/x86_64/squid-cachemgr-3.0-22.4mdv2009.0.x86_64.rpm 
 4bb14790230810c4baacacd4c0f42a74  2009.0/SRPMS/squid-3.0-22.4mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 845a48e585b33f26553afdafdb79fed2  2009.1/i586/squid-3.0-22.4mdv2009.1.i586.rpm
 5887a7ebbd92b1b6129584e3193b8916  2009.1/i586/squid-cachemgr-3.0-22.4mdv2009.1.i586.rpm 
 4161f1ac082be3c97a33f26e5465e8f5  2009.1/SRPMS/squid-3.0-22.4mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 e09fec0589e8f8fe4ecee65e3b56a52f  2009.1/x86_64/squid-3.0-22.4mdv2009.1.x86_64.rpm
 58dad1d858f26989947316da944c412e  2009.1/x86_64/squid-cachemgr-3.0-22.4mdv2009.1.x86_64.rpm 
 4161f1ac082be3c97a33f26e5465e8f5  2009.1/SRPMS/squid-3.0-22.4mdv2009.1.src.rpm

 Mandriva Linux 2010.0:
 c2b0fc893c78169ea1de1d0e681741fb  2010.0/i586/squid-3.0-22.4mdv2010.0.i586.rpm
 013877c3f2930638a85ef21225aeb3a7  2010.0/i586/squid-cachemgr-3.0-22.4mdv2010.0.i586.rpm 
 d8ec42428df3b93be59c4548f029435c  2010.0/SRPMS/squid-3.0-22.4mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 2c25361fc48aa14c03def8f3df6a3e36  2010.0/x86_64/squid-3.0-22.4mdv2010.0.x86_64.rpm
 4f48b44c06ccda8ce392a8d7c14156e3  2010.0/x86_64/squid-cachemgr-3.0-22.4mdv2010.0.x86_64.rpm 
 d8ec42428df3b93be59c4548f029435c  2010.0/SRPMS/squid-3.0-22.4mdv2010.0.src.rpm

 Mandriva Linux 2010.1:
 cb704f8f77cf45864616a53380b67407  2010.1/i586/squid-3.1-14.1mdv2010.1.i586.rpm
 70f434103d5aad68840a3e0840c88a5b  2010.1/i586/squid-cachemgr-3.1-14.1mdv2010.1.i586.rpm 
 b5542ebf1f680c827bfb5d892d2126c2  2010.1/SRPMS/squid-3.1-14.1mdv2010.1.src.rpm

 Mandriva Linux 2010.1/X86_64:
 5be0ea66917bd41c9f1b6db67bb2890a  2010.1/x86_64/squid-3.1-14.1mdv2010.1.x86_64.rpm
 36f104d772da713669eaf4b74b26d75b  2010.1/x86_64/squid-cachemgr-3.1-14.1mdv2010.1.x86_64.rpm 
 b5542ebf1f680c827bfb5d892d2126c2  2010.1/SRPMS/squid-3.1-14.1mdv2010.1.src.rpm

 Mandriva Enterprise Server 5:
 e20d4cc42d58560f3f584017b4dcbdbd  mes5/i586/squid-3.0-22.4mdvmes5.1.i586.rpm
 d00e43fc454df8f96037558183858efa  mes5/i586/squid-cachemgr-3.0-22.4mdvmes5.1.i586.rpm 
 7f59d47bdeafa6b214156bd5c05a7434  mes5/SRPMS/squid-3.0-22.4mdvmes5.1.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 8233892d48af6680a81ae27fe774071f  mes5/x86_64/squid-3.0-22.4mdvmes5.1.x86_64.rpm
 cc8b47ad54fe11e0d62addc394be70b2  mes5/x86_64/squid-cachemgr-3.0-22.4mdvmes5.1.x86_64.rpm 
 7f59d47bdeafa6b214156bd5c05a7434  mes5/SRPMS/squid-3.0-22.4mdvmes5.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFMmiAlmqjQ0CJFipgRAkk4AJ4nhG4aWV0WHgsUbd/AeexbvQjdkQCgnEDZ
2SAr7sK+rCWRWPbyEE4Iy0c=
=kf6Q
-----END PGP SIGNATURE-----