--------------------------------------------------------------------- Fedora Legacy Test Update Notification FEDORALEGACY-2005-2150 Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=2150 2005-02-20 ---------------------------------------------------------------------
Name : squid Versions : rh7.3: squid-2.4.STABLE7-0.73.1.legacy Versions : rh9: squid-2.5.STABLE1-8.9.legacy Versions : fc1: squid-2.5.STABLE3-2.fc1.4.legacy Summary : The Squid proxy caching server. Description : Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DNS lookups, supports non-blocking DNS lookups, and implements negative caching of failed requests.
Squid consists of a main server program squid, a Domain Name System lookup program (dnsserver), a program for retrieving FTP data (ftpget), and some management and client tools.
--------------------------------------------------------------------- Update Information:
An updated Squid package that fixes several security issues is now available.
Squid is a full-featured Web proxy cache.
A buffer overflow was found within the NTLM authentication helper routine. If Squid is configured to use the NTLM authentication helper, a remote attacker could potentially execute arbitrary code by sending a lengthy password. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0541 to this issue.
An out of bounds memory read bug was found within the NTLM authentication helper routine. If Squid is configured to use the NTLM authentication helper, a remote attacker could send a carefully crafted NTLM authentication packet and cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0832 to this issue.
iDEFENSE reported a flaw in the squid SNMP module. This flaw could allow an attacker who has the ability to send arbitrary packets to the SNMP port to restart the server, causing it to drop all open connections. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0918 to this issue.
A buffer overflow flaw was found in the Gopher relay parser. This bug could allow a remote Gopher server to crash the Squid proxy that reads data from it. Although Gopher servers are now quite rare, a malicious web page (for example) could redirect or contain a frame pointing to an attacker's malicious gopher server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0094 to this issue.
An integer overflow flaw was found in the WCCP message parser. It is possible to crash the Squid server if an attacker is able to send a malformed WCCP message with a spoofed source address matching Squid's "home router". The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0095 to this issue.
A memory leak was found in the NTLM fakeauth_auth helper. It is possible that an attacker could place the Squid server under high load, causing the NTML fakeauth_auth helper to consume a large amount of memory, resulting in a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0096 to this issue.
A NULL pointer de-reference bug was found in the NTLM fakeauth_auth helper. It is possible for an attacker to send a malformed NTLM type 3 message, causing the Squid server to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0097 to this issue.
A username validation bug was found in squid_ldap_auth. It is possible for a username to be padded with spaces, which could allow a user to bypass explicit access control rules or confuse accounting. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0173 to this issue.
The way Squid handles HTTP responses was found to need strengthening. It is possible that a malicious web server could send a series of HTTP responses in such a way that the Squid cache could be poisoned, presenting users with incorrect webpages. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2005-0174 and CAN-2005-0175 to these issues.
When processing the configuration file, Squid parses empty Access Control Lists (ACLs) and proxy_auth ACLs without defined auth schemes in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0194 to this issue.
A buffer overflow bug was found in the WCCP message parser. It is possible that an attacker could send a malformed WCCP message which could crash the Squid server or execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0211 to this issue.
A bug was found in the way Squid handled oversized HTTP response headers. It is possible that a malicious web server could send a specially crafted HTTP header which could cause the Squid cache to be poisoned, presenting users with incorrect webpages. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0241 to this issue.
Users of Squid should upgrade to this updated package, which contains backported patches, and is not vulnerable to these issues.
--------------------------------------------------------------------- Changelogs
rh73:
* Wed Feb 16 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 7:2.4.STABLE7-0.73.1.legacy
- Rebuilt as Fedora Legacy security update for Red Hat Linux 7.3
* Tue Feb 01 2005 Jay Fenlason <fenlason@xxxxxxxxxx> - Two more security fixes: * CAN-2005-0211 bz#146777 buffer overflow in wccp recvfrom() call * bz#146780 correct handling of oversize reply headers
* Mon Jan 31 2005 Jay Fenlason <fenlason@xxxxxxxxxx> - Change the squid user's login shell to /sbin/nologin
* Mon Jan 31 2005 Jay Fenlason <fenlason@xxxxxxxxxx> 7:2.4.STABLE7-1.21as.3 - Don't include the 0-length files created by patch in the errors directory.
* Fri Jan 28 2005 Jay Fenlason <fenlason@xxxxxxxxxx> 7:2.4.STABLE7-1.21as.2 - Backport three more security fixes to close bz#146159 - Also backport the -reply_header_max_size patch - Reorganize this spec file to apply upstream patches first.
* Thu Jan 20 2005 Jay Fenlason <fenlason@xxxxxxxxxx> 7:2.4.STABLE7-1.21as.1
- Backport fixes for CAN-2005-0094 (remote DOS in parsing malformed Gopher
messages). and CAN-2005-0095 (remote DOS in parsing malformed wccp messages).
- This version of squid is not vulnerable to CAN-2005-0096 and CAN-2005-0097
because it does not contain the ntlm_auth helper.
* Tue Oct 12 2004 Jay Fenlason <fenlason@xxxxxxxxxx> 7:2.4.STABLE7-1.21as - Backport SNMP_core_dump patch from 2.5.STABLE6 to fix CAN-2004-0918 (Remote DoS)
* Mon Jun 21 2004 Jay Fenlason <fenlason@xxxxxxxxxx> 7:2.4.STABLE7-0.21as - bump to 2.4.STABLE7 to pick up all the post STABLE6 patches - Include the three upstream patches to 2.4.STABLE7 - Add the forward_retries one-line patch for bugzilla #120849
rh9:
* Sat Feb 19 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 7:2.5.STABLE1-8.9.legacy
- Added openssl-devel and cyrus-sasl-devel BuildPrereq
* Wed Feb 16 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 7:2.5.STABLE1-7.9.legacy
- Security patches for CAN-2005-0094, CAN-2005-0095, CAN-2005-0096,
CAN-2005-0097, CAN-2005-0173, CAN-2005-0174, CAN-2005-0175,
CAN-2005-0194, CAN-2005-0211, CAN-2005-0241
* Sat Oct 16 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 7:2.5.STABLE1-6.9.legacy
- CAN-2004-0918 security patch (snmp DoS)
* Fri Sep 10 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 7:2.5.STABLE1-5.9.legacy
- CAN-2004-0832 security patch (malformed NTLMSSP packets crash NTLM helpers)
* Tue Jun 08 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 7:2.5.STABLE1-4.9.legacy
- CAN-2004-0541 security patch (NTLM Authentication Helper Buffer Overflow)
fc1:
* Sun Feb 20 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 7:2.5.STABLE3-2.fc1.4.legacy
- Added missing openssl-devel and cyrus-sasl-devel BuildPrereq
* Wed Feb 16 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 7:2.5.STABLE3-2.fc1.3.legacy
- Security patches for CAN-2005-0094, CAN-2005-0095, CAN-2005-0096,
CAN-2005-0097, CAN-2005-0173, CAN-2005-0174, CAN-2005-0175,
CAN-2005-0194, CAN-2005-0211, CAN-2005-0241
* Tue Oct 12 2004 Rob Myers <rob.myers@xxxxxxxxxxxxxxx> 7:2.5.STABLE3-2.fc1.2.legacy
- apply patch for CAN-2004-0918 bug #2150
- group last patch under fedora legacy security updates
* Tue Oct 05 2004 Rob Myers <rob.myers@xxxxxxxxxxxxxxx> 7:2.5.STABLE3-2.fc1.1.legacy
- apply patch from 2.5.STABLE3-1.fc1 RHEL3 for CAN-2004-0832
--------------------------------------------------------------------- This update can be downloaded from: http://download.fedoralegacy.org/ (sha1sums)
rh7.3:
c926b9ea0a621e8c43f212fcafa0e055a716e111 redhat/7.3/updates-testing/i386/squid-2.4.STABLE7-0.73.1.legacy.i386.rpm
95d6d4f03127ef826a52cef9d96937eab77e9d19 redhat/7.3/updates-testing/SRPMS/squid-2.4.STABLE7-0.73.1.legacy.src.rpm
rh9:
7385ffd5cd640687632742020c121cb0d3eb2c4d redhat/9/updates-testing/i386/squid-2.5.STABLE1-8.9.legacy.i386.rpm
933b43abb420fe4a16694f0d6e134aa3cd08bc6f redhat/9/updates-testing/SRPMS/squid-2.5.STABLE1-8.9.legacy.src.rpm
fc1:
b09fa932d900d1d33c044306f7d73760be2cca62 fedora/1/updates-testing/i386/squid-2.5.STABLE3-2.fc1.4.legacy.i386.rpm
a7ab01398dbce5d1b89f401a700c6c2026b27608 fedora/1/updates-testing/SRPMS/squid-2.5.STABLE3-2.fc1.4.legacy.src.rpm
---------------------------------------------------------------------
Please test and comment in bugzilla.
Attachment:
signature.asc
Description: OpenPGP digital signature
-- fedora-legacy-list@xxxxxxxxxx http://www.redhat.com/mailman/listinfo/fedora-legacy-list
