full-disclosure - [USN-67-1] Squid vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050120194711.GA31206@box79162.elkhouse.de>
From: martin.pitt at canonical.com (Martin Pitt)
Subject: [USN-67-1] Squid vulnerabilities

===========================================================
Ubuntu Security Notice USN-67-1		   January 20, 2005
squid vulnerabilities
CAN-2005-0094, CAN-2005-0095, CAN-2005-0096, CAN-2005-0097
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

squid

The problem can be corrected by upgrading the affected package to
version 2.5.5-6ubuntu0.3.  In general, a standard system upgrade is
sufficient to effect the necessary changes.

Details follow:

infamous41md discovered several Denial of Service vulnerabilities in
squid.

A malicious Gopher server could crash squid by sending a line bigger
than 4096 bytes. (CAN-2005-0094)

If squid is configured to send WCPP (Web Cache Communication Protocol)
messages to a "home router", an attacker who was able to send UDP
packets with a forged source address of this router could crash the

erver with a specially crafted WCPP message. (CAN-2005-0095)

Previous versions of squid have a memory leak which gradually cause
memory exhaustion and eventual termination. (CAN-2005-0096)

A remote attacker could crash the server by sending a specially
crafted NTLM type 3 packet. (CAN-2005-0097)

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.5-6ubuntu0.3.diff.gz
      Size/MD5:   261632 b5eff00520a4a5ae42ea9f6848c19574
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.5-6ubuntu0.3.dsc
      Size/MD5:      652 98bccdccbd9de758502bf8fedb840605
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.5.orig.tar.gz
      Size/MD5:  1363967 6c7f3175b5fa04ab5ee68ce752e7b500

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid-common_2.5.5-6ubuntu0.3_all.deb
      Size/MD5:   185086 b678138da7fe29c4613cb0dad17a2907

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.5-6ubuntu0.3_amd64.deb
      Size/MD5:    89532 0b85d26fcf6984e283c5114af77c6fd3
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.5-6ubuntu0.3_amd64.deb
      Size/MD5:   811426 d77e22c9358bcb48356bbe8d10c60119
    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5.5-6ubuntu0.3_amd64.deb
      Size/MD5:    70860 c08aa5d1322863bae47c14890c014e52

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.5-6ubuntu0.3_i386.deb
      Size/MD5:    88038 106d4406e488ee4f77148cb95e75bb5f
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.5-6ubuntu0.3_i386.deb
      Size/MD5:   726832 24384d77f74454fa88f616162008eafd
    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5.5-6ubuntu0.3_i386.deb
      Size/MD5:    69580 985f64a429db845fbc5919ff58c00eeb

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.5-6ubuntu0.3_powerpc.deb
      Size/MD5:    88972 4668dc70768e79ef115f04636c200502
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.5-6ubuntu0.3_powerpc.deb
      Size/MD5:   794288 8b93b8d27a758f52e84f783148744263
    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5.5-6ubuntu0.3_powerpc.deb
      Size/MD5:    70358 829f568b638019de48ade7f646c134e6
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050120/7f3eba0d/attachment.bin