lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list] 
Message-Id: <E1NdU4y-0001wF-RW@titan.mandriva.com>
Date: Fri, 05 Feb 2010 20:43:00 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:033 ] squid


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:033
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : squid
 Date    : February 5, 2010
 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0,
           Enterprise Server 5.0, Multi Network Firewall 2.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability have been discovered and corrected in Squid 2.x,
 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15, which allows
 remote attackers to cause a denial of service (assertion failure)
 via a crafted DNS packet that only contains a header (CVE-2010-0308).
 
 This update provides a fix to this vulnerability.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0308
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 56d1a099888684549450987984ab07e5  2008.0/i586/squid-2.6.STABLE16-1.5mdv2008.0.i586.rpm
 23ae7f244ee664020270c010d9bffc93  2008.0/i586/squid-cachemgr-2.6.STABLE16-1.5mdv2008.0.i586.rpm 
 952676e8f79dcb3cf48beb693082a055  2008.0/SRPMS/squid-2.6.STABLE16-1.5mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 6e3757e4957a31a2c7b2c698d70a23ec  2008.0/x86_64/squid-2.6.STABLE16-1.5mdv2008.0.x86_64.rpm
 4090afb42b9c821567ef9585f72826de  2008.0/x86_64/squid-cachemgr-2.6.STABLE16-1.5mdv2008.0.x86_64.rpm 
 952676e8f79dcb3cf48beb693082a055  2008.0/SRPMS/squid-2.6.STABLE16-1.5mdv2008.0.src.rpm

 Mandriva Linux 2009.0:
 514ac3e366722bf224c6c268133c8bf5  2009.0/i586/squid-3.0-22.2mdv2009.0.i586.rpm
 af1e6999474f66abd50c0830838c37e1  2009.0/i586/squid-cachemgr-3.0-22.2mdv2009.0.i586.rpm 
 111816fac7c13dac76fc4cbb32c5d5b8  2009.0/SRPMS/squid-3.0-22.2mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 26a88dff2af3b818c765740a226a304a  2009.0/x86_64/squid-3.0-22.2mdv2009.0.x86_64.rpm
 63f5a3ca8f76e30fd55b3d0491161b29  2009.0/x86_64/squid-cachemgr-3.0-22.2mdv2009.0.x86_64.rpm 
 111816fac7c13dac76fc4cbb32c5d5b8  2009.0/SRPMS/squid-3.0-22.2mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 ac595f8e4d801933fa14c9737f2bda2f  2009.1/i586/squid-3.0-22.2mdv2009.1.i586.rpm
 62de73c22f47725da6c437364a46e940  2009.1/i586/squid-cachemgr-3.0-22.2mdv2009.1.i586.rpm 
 c7e94a138db6a4c1388229755aee5140  2009.1/SRPMS/squid-3.0-22.2mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 90303168b09d33f47bce7242b669a214  2009.1/x86_64/squid-3.0-22.2mdv2009.1.x86_64.rpm
 cd8aaa4a61c8ecdb5170bd9cc0d3c1f3  2009.1/x86_64/squid-cachemgr-3.0-22.2mdv2009.1.x86_64.rpm 
 c7e94a138db6a4c1388229755aee5140  2009.1/SRPMS/squid-3.0-22.2mdv2009.1.src.rpm

 Mandriva Linux 2010.0:
 eddb97e4799437f2cf0a78c6a359cb5e  2010.0/i586/squid-3.0-22.2mdv2010.0.i586.rpm
 555c13ad31b3b6aacd50bbfcb6fa9eef  2010.0/i586/squid-cachemgr-3.0-22.2mdv2010.0.i586.rpm 
 7f79b208080e8e3ead74b69e7ac840e5  2010.0/SRPMS/squid-3.0-22.2mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 a13f8f1b479b99bdc40ddc5ad86d0be4  2010.0/x86_64/squid-3.0-22.2mdv2010.0.x86_64.rpm
 d648754975631b54d6bc992a0e39cbae  2010.0/x86_64/squid-cachemgr-3.0-22.2mdv2010.0.x86_64.rpm 
 7f79b208080e8e3ead74b69e7ac840e5  2010.0/SRPMS/squid-3.0-22.2mdv2010.0.src.rpm

 Corporate 4.0:
 0bd70b523f3e0d4d6a3b61b3e42997d1  corporate/4.0/i586/squid-2.6.STABLE1-4.7.20060mlcs4.i586.rpm
 934c278650d457d10adda359441432e2  corporate/4.0/i586/squid-cachemgr-2.6.STABLE1-4.7.20060mlcs4.i586.rpm 
 357f99500713686172ab432852f9d3c2  corporate/4.0/SRPMS/squid-2.6.STABLE1-4.7.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 18b0b7e594cbab3d6c19a1a017b7d4b0  corporate/4.0/x86_64/squid-2.6.STABLE1-4.7.20060mlcs4.x86_64.rpm
 a22aace447ac83f960fa58fa7e8a1329  corporate/4.0/x86_64/squid-cachemgr-2.6.STABLE1-4.7.20060mlcs4.x86_64.rpm 
 357f99500713686172ab432852f9d3c2  corporate/4.0/SRPMS/squid-2.6.STABLE1-4.7.20060mlcs4.src.rpm

 Mandriva Enterprise Server 5:
 0672692de71c27f8f39e9908b3738c41  mes5/i586/squid-3.0-22.2mdvmes5.i586.rpm
 369ada9958ee2314f05c521ebcfdf538  mes5/i586/squid-cachemgr-3.0-22.2mdvmes5.i586.rpm 
 c016e10f40be982e8721bd25d7cbde2b  mes5/SRPMS/squid-3.0-22.2mdvmes5.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 ed47df165089fab968431ca1530e609e  mes5/x86_64/squid-3.0-22.2mdvmes5.x86_64.rpm
 52c1eefa1b67c95d50ade95e2b37b4ae  mes5/x86_64/squid-cachemgr-3.0-22.2mdvmes5.x86_64.rpm 
 c016e10f40be982e8721bd25d7cbde2b  mes5/SRPMS/squid-3.0-22.2mdvmes5.src.rpm

 Multi Network Firewall 2.0:
 e42b3292a67b734d582f565ffb7376ce  mnf/2.0/i586/squid-2.5.STABLE9-1.11.M20mdk.i586.rpm 
 288d79b7fa0bdf3e3c3ae17b65a661ac  mnf/2.0/SRPMS/squid-2.5.STABLE9-1.11.M20mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLbETtmqjQ0CJFipgRAgrOAKDfmBXv7ZKffTKHwH71Zq8CanAv3QCg3gT2
QstUAAOi99OUju/Jgx1QWm4=
=GZzx
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ