full-disclosure-uk January 2010 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] [ MDVSA-2009:241-1 ] squid

[Full-disclosure] [ MDVSA-2009:241-1 ] squid

From: <security_at_nospam>
Date: Mon Jan 11 2010 - 20:29:00 GMT
To: full-disclosure@lists.grok.org.uk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2009:241-1  http://www.mandriva.com/security/
Package : squid Date : January 11, 2010 Affected: 2008.0
_______________________________________________________________________

 Problem Description:

 A vulnerability was discovered and corrected in squid:  

 The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7  allows remote attackers to cause a denial of service via a crafted  auth header with certain comma delimiters that trigger an infinite  loop of calls to the strcspn function (CVE-2009-2855).  

 This update provides a solution to this vulnerability.

 Update:

 Packages for 2008.0 are provided for Corporate Desktop 2008.0  customers.


 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2855


 Updated Packages:

 Mandriva Linux 2008.0: e4c9373aabe23a99038535933cadfcdf 2008.0/i586/squid-2.6.STABLE16-1.4mdv2008.0.i586.rpm 264a75acfe38304d56f246ced43c0b77 2008.0/i586/squid-cachemgr-2.6.STABLE16-1.4mdv2008.0.i586.rpm c5cb0059c20cf425ae1eb5320fb88d9a 2008.0/SRPMS/squid-2.6.STABLE16-1.4mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64: 736aebebdae4217c764a3a27d352f162 2008.0/x86_64/squid-2.6.STABLE16-1.4mdv2008.0.x86_64.rpm bac27002220cdbe610a1dc5cfb249603 2008.0/x86_64/squid-cachemgr-2.6.STABLE16-1.4mdv2008.0.x86_64.rpm c5cb0059c20cf425ae1eb5320fb88d9a 2008.0/SRPMS/squid-2.6.STABLE16-1.4mdv2008.0.src.rpm
_______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi. The verification  of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security. You can obtain the  GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com


 Type Bits/KeyID Date User ID
 pub 1024D/22458A98 2000-07-10 Mandriva Security Team   <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLS16KmqjQ0CJFipgRAtkWAJ41RYElygKvE+mNiEahH9mrolMmSgCfc+LZ PPkZg8mJLqu1BaIf56PCYiU=
=E+fE
-----END PGP SIGNATURE-----



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/