[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1OyUQC-0003CN-Ta@titan.mandriva.com>
Date: Wed, 22 Sep 2010 20:52:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:187 ] squid
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2010:187
http://www.mandriva.com/security/
_______________________________________________________________________
Package : squid
Date : September 22, 2010
Affected: 2009.0, 2009.1, 2010.0, 2010.1, Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
A vulnerability has been found and corrected in squid:
The string-comparison functions in String.cci in Squid 3.x before
3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a
denial of service (NULL pointer dereference and daemon crash) via a
crafted request (CVE-2010-3072).
Packages for 2008.0 and 2009.0 are provided as of the Extended
Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490
The updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3072
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2009.0:
1639b62ea33f02fd7279621f4b5f1348 2009.0/i586/squid-3.0-22.4mdv2009.0.i586.rpm
be2fb2e56e983f0240f32df7c63faff5 2009.0/i586/squid-cachemgr-3.0-22.4mdv2009.0.i586.rpm
4bb14790230810c4baacacd4c0f42a74 2009.0/SRPMS/squid-3.0-22.4mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
da3a655ce40185905ee4a4a2e13c5f07 2009.0/x86_64/squid-3.0-22.4mdv2009.0.x86_64.rpm
9ff19b9924ebaae5b01154e22a29da3d 2009.0/x86_64/squid-cachemgr-3.0-22.4mdv2009.0.x86_64.rpm
4bb14790230810c4baacacd4c0f42a74 2009.0/SRPMS/squid-3.0-22.4mdv2009.0.src.rpm
Mandriva Linux 2009.1:
845a48e585b33f26553afdafdb79fed2 2009.1/i586/squid-3.0-22.4mdv2009.1.i586.rpm
5887a7ebbd92b1b6129584e3193b8916 2009.1/i586/squid-cachemgr-3.0-22.4mdv2009.1.i586.rpm
4161f1ac082be3c97a33f26e5465e8f5 2009.1/SRPMS/squid-3.0-22.4mdv2009.1.src.rpm
Mandriva Linux 2009.1/X86_64:
e09fec0589e8f8fe4ecee65e3b56a52f 2009.1/x86_64/squid-3.0-22.4mdv2009.1.x86_64.rpm
58dad1d858f26989947316da944c412e 2009.1/x86_64/squid-cachemgr-3.0-22.4mdv2009.1.x86_64.rpm
4161f1ac082be3c97a33f26e5465e8f5 2009.1/SRPMS/squid-3.0-22.4mdv2009.1.src.rpm
Mandriva Linux 2010.0:
c2b0fc893c78169ea1de1d0e681741fb 2010.0/i586/squid-3.0-22.4mdv2010.0.i586.rpm
013877c3f2930638a85ef21225aeb3a7 2010.0/i586/squid-cachemgr-3.0-22.4mdv2010.0.i586.rpm
d8ec42428df3b93be59c4548f029435c 2010.0/SRPMS/squid-3.0-22.4mdv2010.0.src.rpm
Mandriva Linux 2010.0/X86_64:
2c25361fc48aa14c03def8f3df6a3e36 2010.0/x86_64/squid-3.0-22.4mdv2010.0.x86_64.rpm
4f48b44c06ccda8ce392a8d7c14156e3 2010.0/x86_64/squid-cachemgr-3.0-22.4mdv2010.0.x86_64.rpm
d8ec42428df3b93be59c4548f029435c 2010.0/SRPMS/squid-3.0-22.4mdv2010.0.src.rpm
Mandriva Linux 2010.1:
cb704f8f77cf45864616a53380b67407 2010.1/i586/squid-3.1-14.1mdv2010.1.i586.rpm
70f434103d5aad68840a3e0840c88a5b 2010.1/i586/squid-cachemgr-3.1-14.1mdv2010.1.i586.rpm
b5542ebf1f680c827bfb5d892d2126c2 2010.1/SRPMS/squid-3.1-14.1mdv2010.1.src.rpm
Mandriva Linux 2010.1/X86_64:
5be0ea66917bd41c9f1b6db67bb2890a 2010.1/x86_64/squid-3.1-14.1mdv2010.1.x86_64.rpm
36f104d772da713669eaf4b74b26d75b 2010.1/x86_64/squid-cachemgr-3.1-14.1mdv2010.1.x86_64.rpm
b5542ebf1f680c827bfb5d892d2126c2 2010.1/SRPMS/squid-3.1-14.1mdv2010.1.src.rpm
Mandriva Enterprise Server 5:
e20d4cc42d58560f3f584017b4dcbdbd mes5/i586/squid-3.0-22.4mdvmes5.1.i586.rpm
d00e43fc454df8f96037558183858efa mes5/i586/squid-cachemgr-3.0-22.4mdvmes5.1.i586.rpm
7f59d47bdeafa6b214156bd5c05a7434 mes5/SRPMS/squid-3.0-22.4mdvmes5.1.src.rpm
Mandriva Enterprise Server 5/X86_64:
8233892d48af6680a81ae27fe774071f mes5/x86_64/squid-3.0-22.4mdvmes5.1.x86_64.rpm
cc8b47ad54fe11e0d62addc394be70b2 mes5/x86_64/squid-cachemgr-3.0-22.4mdvmes5.1.x86_64.rpm
7f59d47bdeafa6b214156bd5c05a7434 mes5/SRPMS/squid-3.0-22.4mdvmes5.1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFMmiAlmqjQ0CJFipgRAkk4AJ4nhG4aWV0WHgsUbd/AeexbvQjdkQCgnEDZ
2SAr7sK+rCWRWPbyEE4Iy0c=
=kf6Q
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists