BugTraq
[ MDVSA-2013:013 ] squid Feb 20 2013 01:46PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:013
http://www.mandriva.com/security/
_______________________________________________________________________

Package : squid
Date : February 20, 2013
Affected: 2011., Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been found and corrected in squid
(cachemgr.cgi):

Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid
2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before
3.3.0.2 allow remote attackers to cause a denial of service (memory
consumption) via (1) invalid Content-Length headers, (2) long POST
requests, or (3) crafted authentication credentials (CVE-2012-5643).

cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and
other versions, allows remote attackers to cause a denial of service
(resource consumption) via a crafted request. NOTE: this issue is
due to an incorrect fix for CVE-2012-5643, possibly involving an
incorrect order of arguments or incorrect comparison (CVE-2013-0189).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5643
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0189
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2011:
be6b1b58b23adf78655e154a0d9b4425 2011/i586/squid-3.1.15-1.3-mdv2011.0.i586.rpm
87d5c4f17ec9609a6c23bde3254f1607 2011/i586/squid-cachemgr-3.1.15-1.3-mdv2011.0.i586.rpm
defcc1655b36cb5708f281311d6f14e5 2011/SRPMS/squid-3.1.15-1.3.src.rpm

Mandriva Linux 2011/X86_64:
47252ced15dc7132ccc49db09f211507 2011/x86_64/squid-3.1.15-1.3-mdv2011.0.x86_64.rpm
b2cc7e05622308c13826397b9e9920c3 2011/x86_64/squid-cachemgr-3.1.15-1.3-mdv2011.0.x86_64.rpm
defcc1655b36cb5708f281311d6f14e5 2011/SRPMS/squid-3.1.15-1.3.src.rpm

Mandriva Enterprise Server 5:
951ed0c1ac4f41a20fa668602d9527b2 mes5/i586/squid-3.0-22.6mdvmes5.2.i586.rpm
480f84eb3ec2d8edef1f30d849add394 mes5/i586/squid-cachemgr-3.0-22.6mdvmes5.2.i586.rpm
882f87c2db26259b5f1c7600cde80196 mes5/SRPMS/squid-3.0-22.6mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
816be462b15ab4aeb3304c8f40cdf7a7 mes5/x86_64/squid-3.0-22.6mdvmes5.2.x86_64.rpm
71654b5c9dfe52d184c5ea535db5b4b4 mes5/x86_64/squid-cachemgr-3.0-22.6mdvmes5.2.x86_64.rpm
882f87c2db26259b5f1c7600cde80196 mes5/SRPMS/squid-3.0-22.6mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFRJKaMmqjQ0CJFipgRAqXZAJ9/daTMtTTbwS557KYt3l7GU0QvxwCeJwk6
uYvOYSvVhXV6LILM7700ex0=
=QCol
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus