Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » MDKSA-2002:016-1-squid

MDKSA-2002:016-1-squid

by Nikola Strahija on February 27th, 2002 Three security issues were found in the 2.x versions of the Squid proxy server up to and including 2.4.STABLE3.


The first is a memory leak in
the optional SNMP interface to Squid which could allow a malicious user
who can send packets to the Squid SNMP port to possibly perform a
Denial of Service attack on ther server if the SNMP interface is
enabled. The next is a buffer overflow in the implementation of ftp://
URLs where allowed users could possibly perform a DoS on the server,
and may be able to trigger remote execution of code (which the authors
have not yet confirmed). The final issue is with the HTCP interface
which cannot be properly disabled from squid.conf; HTCP is enabled by
default on Mandrake Linux systems.

Update:

The squid updates for all versions other than Mandrake Linux were
incorrectly built with LDAP authentication which introduced a
dependency on OpenLDAP. These new packages do not use LDAP
authentication. The Single Network Firewall 7.2 package previously
released did not use LDAP authentication, however rebuilding the source
RPM package required LDAP to be installed. Single Network Firewall 7.2
users do not need to upgrade to these packages to have a properly
function squid.
________________________________________________________________________

References:

http://www.squid-cache.org/Advisories/SQUID-2002_1.txt
________________________________________________________________________

Updated Packages:

Linux-Mandrake 7.1:
60bb70afa95f2b43727bc8c9794fb0f9 7.1/RPMS/squid-2.4.STABLE4-1.5mdk.i586.rpm
a46c4bf51883fcfee529de2812f55458 7.1/SRPMS/squid-2.4.STABLE4-1.5mdk.src.rpm

Linux-Mandrake 7.2:
0c3cfdf038650a8c85e703c8859df8d7 7.2/RPMS/squid-2.4.STABLE4-1.5mdk.i586.rpm
a46c4bf51883fcfee529de2812f55458 7.2/SRPMS/squid-2.4.STABLE4-1.5mdk.src.rpm

Mandrake Linux 8.0:
174eaf577cfde553ee0b8eb301792cba 8.0/RPMS/squid-2.4.STABLE4-1.6mdk.i586.rpm
e1d0df4fe930669e3ba12b90caefeca3 8.0/SRPMS/squid-2.4.STABLE4-1.6mdk.src.rpm

Mandrake Linux 8.0/ppc:
375ecbfec5947e9f47be3ada5084fc88
ppc/8.0/RPMS/squid-2.4.STABLE4-1.6mdk.ppc.rpm
e1d0df4fe930669e3ba12b90caefeca3
ppc/8.0/SRPMS/squid-2.4.STABLE4-1.6mdk.src.rpm

Corporate Server 1.0.1:
60bb70afa95f2b43727bc8c9794fb0f9 1.0.1/RPMS/squid-2.4.STABLE4-1.5mdk.i586.rpm
a46c4bf51883fcfee529de2812f55458 1.0.1/SRPMS/squid-2.4.STABLE4-1.5mdk.src.rpm

Single Network Firewall 7.2:
0c3cfdf038650a8c85e703c8859df8d7
snf7.2/RPMS/squid-2.4.STABLE4-1.5mdk.i586.rpm
a46c4bf51883fcfee529de2812f55458
snf7.2/SRPMS/squid-2.4.STABLE4-1.5mdk.src.rpm
________________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

________________________________________________________________________

To upgrade automatically, use MandrakeUpdate. The verification of md5
checksums and GPG signatures is performed automatically for you.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". A list of
FTP mirrors can be obtained from:

http://www.mandrakesecure.net/en/ftp.php

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package. You can do this with the command:

rpm --checksig

All packages are signed by MandrakeSoft for security. You can obtain
the GPG public key of the Mandrake Linux Security Team from:

https://www.mandrakesecure.net/RPM-GPG-KEYS

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other update advisories for Mandrake Linux at:

http://www.mandrakesecure.net/en/advisories/

MandrakeSoft has several security-related mailing list services that
anyone can subscribe to. Information on these lists can be obtained by
visiting:

http://www.mandrakesecure.net/en/mlist.php

If you want to report vulnerabilities, please contact

[email protected]
________________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team




Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »