[ MDVSA-2009:241-1 ] squid




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2009:241-1
http://www.mandriva.com/security/
_______________________________________________________________________

Package : squid
Date : January 11, 2010
Affected: 2008.0
_______________________________________________________________________

Problem Description:

A vulnerability was discovered and corrected in squid:

The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7
allows remote attackers to cause a denial of service via a crafted
auth header with certain comma delimiters that trigger an infinite
loop of calls to the strcspn function (CVE-2009-2855).

This update provides a solution to this vulnerability.

Update:

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2855
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2008.0:
e4c9373aabe23a99038535933cadfcdf 2008.0/i586/squid-2.6.STABLE16-1.4mdv2008.0.i586.rpm
264a75acfe38304d56f246ced43c0b77 2008.0/i586/squid-cachemgr-2.6.STABLE16-1.4mdv2008.0.i586.rpm
c5cb0059c20cf425ae1eb5320fb88d9a 2008.0/SRPMS/squid-2.6.STABLE16-1.4mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
736aebebdae4217c764a3a27d352f162 2008.0/x86_64/squid-2.6.STABLE16-1.4mdv2008.0.x86_64.rpm
bac27002220cdbe610a1dc5cfb249603 2008.0/x86_64/squid-cachemgr-2.6.STABLE16-1.4mdv2008.0.x86_64.rpm
c5cb0059c20cf425ae1eb5320fb88d9a 2008.0/SRPMS/squid-2.6.STABLE16-1.4mdv2008.0.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLS16KmqjQ0CJFipgRAtkWAJ41RYElygKvE+mNiEahH9mrolMmSgCfc+LZ
PPkZg8mJLqu1BaIf56PCYiU=
=E+fE
-----END PGP SIGNATURE-----



Relevant Pages