Message-Id: <E1NpU1V-00048D-20@titan.mandriva.com>
Date: Wed, 10 Mar 2010 23:05:00 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:060 ] squid


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:060
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : squid
 Date    : March 10, 2010
 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0,
           Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been found and corrected in squid:
 
 The htcpHandleTstRequest function in htcp.c in Squid 2.x and 3.0
 through 3.0.STABLE23 allows remote attackers to cause a denial of
 service (crash) via crafted packets to the HTCP port, which triggers
 a NULL pointer dereference (CVE-2010-0639).
 
 Packages for 2008.0 are provided for Corporate Desktop 2008.0
 customers.
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0639
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 3bb62371c083cd0130b479ef73ce7489  2008.0/i586/squid-2.6.STABLE16-1.6mdv2008.0.i586.rpm
 060e502078986557f3b32f0228da01bf  2008.0/i586/squid-cachemgr-2.6.STABLE16-1.6mdv2008.0.i586.rpm 
 4b78da465669654765d822825fcd414b  2008.0/SRPMS/squid-2.6.STABLE16-1.6mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 8cb3014403af95f41c256984031c1085  2008.0/x86_64/squid-2.6.STABLE16-1.6mdv2008.0.x86_64.rpm
 1a1038765d1711287cba91b16343a81a  2008.0/x86_64/squid-cachemgr-2.6.STABLE16-1.6mdv2008.0.x86_64.rpm 
 4b78da465669654765d822825fcd414b  2008.0/SRPMS/squid-2.6.STABLE16-1.6mdv2008.0.src.rpm

 Mandriva Linux 2009.0:
 7a44a9bfbc235106493ac4a250c2d93f  2009.0/i586/squid-3.0-22.3mdv2009.0.i586.rpm
 262556382292ccb76cf24086514784b3  2009.0/i586/squid-cachemgr-3.0-22.3mdv2009.0.i586.rpm 
 7cd2d744d64acb11f2f7c41395f2c5f4  2009.0/SRPMS/squid-3.0-22.3mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 4570a0929e1926a8b05b2d716ef5d41f  2009.0/x86_64/squid-3.0-22.3mdv2009.0.x86_64.rpm
 1793a917a78ea514bab6ba8d1b5aa3a8  2009.0/x86_64/squid-cachemgr-3.0-22.3mdv2009.0.x86_64.rpm 
 7cd2d744d64acb11f2f7c41395f2c5f4  2009.0/SRPMS/squid-3.0-22.3mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 e65a2e91b90f4af3c599803848e7c2b1  2009.1/i586/squid-3.0-22.3mdv2009.1.i586.rpm
 e32a27c1bacf27ac906a3a2f437c041e  2009.1/i586/squid-cachemgr-3.0-22.3mdv2009.1.i586.rpm 
 2e055989ed62c349d42536bbfde8e860  2009.1/SRPMS/squid-3.0-22.3mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 50d33092c22a708d860ede90fb25eb5b  2009.1/x86_64/squid-3.0-22.3mdv2009.1.x86_64.rpm
 dc8101306bbe7d0580c960692f14d128  2009.1/x86_64/squid-cachemgr-3.0-22.3mdv2009.1.x86_64.rpm 
 2e055989ed62c349d42536bbfde8e860  2009.1/SRPMS/squid-3.0-22.3mdv2009.1.src.rpm

 Mandriva Linux 2010.0:
 9afc94e4e902f0b5329435a7e965231a  2010.0/i586/squid-3.0-22.3mdv2010.0.i586.rpm
 2376021d46ffc9e400ac22de7f9fab62  2010.0/i586/squid-cachemgr-3.0-22.3mdv2010.0.i586.rpm 
 06f57e474157a43bdb51311ee922e450  2010.0/SRPMS/squid-3.0-22.3mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 9a8a7b62b21adc7c99549af71e4c90b1  2010.0/x86_64/squid-3.0-22.3mdv2010.0.x86_64.rpm
 c1181058d7a70ebbf5816033036843b2  2010.0/x86_64/squid-cachemgr-3.0-22.3mdv2010.0.x86_64.rpm 
 06f57e474157a43bdb51311ee922e450  2010.0/SRPMS/squid-3.0-22.3mdv2010.0.src.rpm

 Corporate 4.0:
 921d752f9ed857f7b20fccf459d7aee9  corporate/4.0/i586/squid-2.6.STABLE1-4.8.20060mlcs4.i586.rpm
 c70b3945e4f0ab94e56fc5293b03ca6e  corporate/4.0/i586/squid-cachemgr-2.6.STABLE1-4.8.20060mlcs4.i586.rpm 
 8d23abb13dd7104a28c1773ff0e5fd6a  corporate/4.0/SRPMS/squid-2.6.STABLE1-4.8.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 5d055b14135028d9f7fb46b96482497e  corporate/4.0/x86_64/squid-2.6.STABLE1-4.8.20060mlcs4.x86_64.rpm
 71bcfd3ab4542af01d1d88aedaa8c146  corporate/4.0/x86_64/squid-cachemgr-2.6.STABLE1-4.8.20060mlcs4.x86_64.rpm 
 8d23abb13dd7104a28c1773ff0e5fd6a  corporate/4.0/SRPMS/squid-2.6.STABLE1-4.8.20060mlcs4.src.rpm

 Mandriva Enterprise Server 5:
 de251a3d6cbca2a0803a9354debed860  mes5/i586/squid-3.0-22.3mdvmes5.i586.rpm
 75ca4e3fddcd82f8df9f8f49b57c6d3b  mes5/i586/squid-cachemgr-3.0-22.3mdvmes5.i586.rpm 
 0e10a36d21627d21e45912efb9918adf  mes5/SRPMS/squid-3.0-22.3mdv2009.0.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 57c04fd78d5f34e7ec02c078783a8e66  mes5/x86_64/squid-3.0-22.3mdvmes5.x86_64.rpm
 ef83faf8855a2f6d21c17191f4b83671  mes5/x86_64/squid-cachemgr-3.0-22.3mdvmes5.x86_64.rpm 
 0e10a36d21627d21e45912efb9918adf  mes5/SRPMS/squid-3.0-22.3mdv2009.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLl+eTmqjQ0CJFipgRAi1GAKCo4N+EdLZ+DC1iOoqhR+CrRnfv2gCgjwcc
3urRtcrC58nZ7l2Tm+5uGgo=
=L0/O
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists