User: Password:
|
|
Subscribe / Log in / New account

Red Hat alert RHSA-2005:489-01 (squid)

From:  bugzilla@redhat.com
To:  enterprise-watch-list@redhat.com
Subject:  [RHSA-2005:489-01] Low: squid security update
Date:  Mon, 13 Jun 2005 08:37 -0400

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Low: squid security update Advisory ID: RHSA-2005:489-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-489.html Issue date: 2005-06-13 Updated on: 2005-06-13 Product: Red Hat Enterprise Linux CVE Names: CVE-1999-0710 CAN-2005-0718 CAN-2005-1519 - --------------------------------------------------------------------- 1. Summary: An updated squid package that fixes several security issues is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 3. Problem description: Squid is a full-featured Web proxy cache. A bug was found in the way Squid handles PUT and POST requests. It is possible for an authorised remote user to cause a failed PUT or POST request which can cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0718 to this issue. A bug was found in the way Squid handles access to the cachemgr.cgi script. It is possible for an authorised remote user to bypass access control lists with this flaw. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-0710 to this issue. A bug was found in the way Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall, it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1519 to this issue. Additionally, this update fixes the following bugs: - squid fails in the unpacking of squid-2.4.STABLE7-1.21as.5.src.rpm Users of Squid should upgrade to this updated package, which contains backported patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ 5. Bug IDs fixed (http://bugzilla.redhat.com/): 125007 - insecure permissions for squid.conf 151423 - CAN-2005-0718 Segmentation fault on failed PUT/POST request 153960 - It fails in the unpacking of squid-2.4.STABLE7-1.21as.5.src.rpm 156161 - CVE-1999-0710 cachemgr.cgi access control bypass 157455 - CAN-2005-1519 DNS lookups unreliable on untrusted networks 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/squ... 94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm i386: 08c0d416b59e426120c9f7932e974f9d squid-2.4.STABLE7-1.21as.8.i386.rpm ia64: 9e15091928dd05b3f8dcf9f2285bd608 squid-2.4.STABLE7-1.21as.8.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/squ... 94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm ia64: 9e15091928dd05b3f8dcf9f2285bd608 squid-2.4.STABLE7-1.21as.8.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/squ... 94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm i386: 08c0d416b59e426120c9f7932e974f9d squid-2.4.STABLE7-1.21as.8.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0710 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0718 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1519 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2005 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFCrX36XlSAg2UNWIIRAi9tAJ9u1K3/IT/MIxtNb4Erms53mtBGuACfd/k9 qrfd67V28A0ZG/vfQc5t97I= =LtXt -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list Enterprise-watch-list@redhat.com https://www.redhat.com/mailman/listinfo/enterprise-watch-...


(Log in to post comments)


Copyright © 2018, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds