Users login

Create an account »


Users login

Home » Hacking News » MDKSA-2002:016-1-squid


by Nikola Strahija on February 27th, 2002 Three security issues were found in the 2.x versions of the Squid proxy server up to and including 2.4.STABLE3.

The first is a memory leak in
the optional SNMP interface to Squid which could allow a malicious user
who can send packets to the Squid SNMP port to possibly perform a
Denial of Service attack on ther server if the SNMP interface is
enabled. The next is a buffer overflow in the implementation of ftp://
URLs where allowed users could possibly perform a DoS on the server,
and may be able to trigger remote execution of code (which the authors
have not yet confirmed). The final issue is with the HTCP interface
which cannot be properly disabled from squid.conf; HTCP is enabled by
default on Mandrake Linux systems.


The squid updates for all versions other than Mandrake Linux were
incorrectly built with LDAP authentication which introduced a
dependency on OpenLDAP. These new packages do not use LDAP
authentication. The Single Network Firewall 7.2 package previously
released did not use LDAP authentication, however rebuilding the source
RPM package required LDAP to be installed. Single Network Firewall 7.2
users do not need to upgrade to these packages to have a properly
function squid.


Updated Packages:

Linux-Mandrake 7.1:
60bb70afa95f2b43727bc8c9794fb0f9 7.1/RPMS/squid-2.4.STABLE4-1.5mdk.i586.rpm
a46c4bf51883fcfee529de2812f55458 7.1/SRPMS/squid-2.4.STABLE4-1.5mdk.src.rpm

Linux-Mandrake 7.2:
0c3cfdf038650a8c85e703c8859df8d7 7.2/RPMS/squid-2.4.STABLE4-1.5mdk.i586.rpm
a46c4bf51883fcfee529de2812f55458 7.2/SRPMS/squid-2.4.STABLE4-1.5mdk.src.rpm

Mandrake Linux 8.0:
174eaf577cfde553ee0b8eb301792cba 8.0/RPMS/squid-2.4.STABLE4-1.6mdk.i586.rpm
e1d0df4fe930669e3ba12b90caefeca3 8.0/SRPMS/squid-2.4.STABLE4-1.6mdk.src.rpm

Mandrake Linux 8.0/ppc:

Corporate Server 1.0.1:
60bb70afa95f2b43727bc8c9794fb0f9 1.0.1/RPMS/squid-2.4.STABLE4-1.5mdk.i586.rpm
a46c4bf51883fcfee529de2812f55458 1.0.1/SRPMS/squid-2.4.STABLE4-1.5mdk.src.rpm

Single Network Firewall 7.2:

Bug IDs fixed (see for more information):


To upgrade automatically, use MandrakeUpdate. The verification of md5
checksums and GPG signatures is performed automatically for you.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". A list of
FTP mirrors can be obtained from:

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package. You can do this with the command:

rpm --checksig

All packages are signed by MandrakeSoft for security. You can obtain
the GPG public key of the Mandrake Linux Security Team from:

Please be aware that sometimes it takes the mirrors a few hours to

You can view other update advisories for Mandrake Linux at:

MandrakeSoft has several security-related mailing list services that
anyone can subscribe to. Information on these lists can be obtained by

If you want to report vulnerabilities, please contact

[email protected]

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team

Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.


Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »