[CLA-2004:882] Conectiva Security Announcement - squid

From: Conectiva Updates (secure_at_conectiva.com.br)
Date: 11/03/04

  • Next message: Martin Pitt: "[USN-16-1] perl vulnerabilities"
    Date: Wed, 3 Nov 2004 10:48:39 -0200
    To: conectiva-updates@papaleguas.conectiva.com.br, lwn@lwn.net, bugtraq@securityfocus.com, security-alerts@linuxsecurity.com, linsec@lists.seifried.org
    
    

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - --------------------------------------------------------------------------
    CONECTIVA LINUX SECURITY ANNOUNCEMENT
    - --------------------------------------------------------------------------

    PACKAGE : squid
    SUMMARY : Fixes for squid vulnerabilities
    DATE : 2004-11-03 10:48:00
    ID : CLA-2004:882
    RELEVANT
    RELEASES : 9, 10

    - -------------------------------------------------------------------------

    DESCRIPTION
     Squid[1] is a full-featured web proxy cache.
     
     This announcement fixes a denial of service vulnerability[2] in squid
     caused by a malformed NTLMSSP packet. This causes a negative value to
     be passed to memcpy on servers with NTLM authentication enabled,
     making squid abort and causing a denial of service condition.
     
     Fixes for two segmentation faults were also included: when using a
     blank user name in digest authentication[3] and after the message
     "Likely proxy abuse detected" has been printed to cache.log[4].
     
     Also fixes a denial of service situation[5] caused by certain
     malformed SNMP requests that when received by squid could restart it
     with a segmentation fault error.
     
     For Conectiva Linux 9, this announcement also fixes a buffer overflow
     vulnerability[6] in the ntlm_check_auth (NTLM authentication)
     function that allowed remote attackers to execute arbitrary code via
     a long password.

    SOLUTION
     It is recommended that all squid users upgrade to the latest
     packages. This update will automatically restart the service if it is
     already running.
     
     
     REFERENCES
     1.http://squid.nlanr.net/
     2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0832
     3.http://www1.uk.squid-cache.org/squid/Versions/v2/2.5/bugs/#squid-2.5.STABLE5-digest_blank
     4.http://www1.uk.squid-cache.org/squid/Versions/v2/2.5/bugs/#squid-2.5.STABLE5-proxy_abuse
     5.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0918
     6.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0541

    UPDATED PACKAGES
    ftp://atualizacoes.conectiva.com.br/10/SRPMS/squid-2.5.5-63116U10_4cl.src.rpm
    ftp://atualizacoes.conectiva.com.br/10/RPMS/squid-2.5.5-63116U10_4cl.i386.rpm
    ftp://atualizacoes.conectiva.com.br/10/RPMS/squid-auth-2.5.5-63116U10_4cl.i386.rpm
    ftp://atualizacoes.conectiva.com.br/10/RPMS/squid-extra-templates-2.5.5-63116U10_4cl.i386.rpm
    ftp://atualizacoes.conectiva.com.br/9/SRPMS/squid-2.5.5-25761U90_7cl.src.rpm
    ftp://atualizacoes.conectiva.com.br/9/RPMS/squid-2.5.5-25761U90_7cl.i386.rpm
    ftp://atualizacoes.conectiva.com.br/9/RPMS/squid-auth-2.5.5-25761U90_7cl.i386.rpm
    ftp://atualizacoes.conectiva.com.br/9/RPMS/squid-extra-templates-2.5.5-25761U90_7cl.i386.rpm

    ADDITIONAL INSTRUCTIONS
     The apt tool can be used to perform RPM packages upgrades:

     - run: apt-get update
     - after that, execute: apt-get upgrade

     Detailed instructions regarding the use of apt and upgrade examples
     can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

    - -------------------------------------------------------------------------
    All packages are signed with Conectiva's GPG key. The key and instructions
    on how to import it can be found at
    http://distro.conectiva.com.br/seguranca/chave/?idioma=en
    Instructions on how to check the signatures of the RPM packages can be
    found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

    - -------------------------------------------------------------------------
    All our advisories and generic update instructions can be viewed at
    http://distro.conectiva.com.br/atualizacoes/?idioma=en

    - -------------------------------------------------------------------------
    Copyright (c) 2004 Conectiva Inc.
    http://www.conectiva.com

    - -------------------------------------------------------------------------
    subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
    unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.6 (GNU/Linux)
    Comment: For info see http://www.gnupg.org

    iD8DBQFBiNOm42jd0JmAcZARAuHhAKCQ6gd4JsoVtoGECoI3urtPR4kGhACeKiPB
    nU7lhnlGZ+D+uhuNqdA1qyk=
    =71kq
    -----END PGP SIGNATURE-----


  • Next message: Martin Pitt: "[USN-16-1] perl vulnerabilities"