---------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated squid package fixes security issues
Advisory ID: FLSA:152809
Issue date: 2006-02-18
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
CVE Names: CVE-2004-0541 CVE-2004-0832 CVE-2004-0918
CVE-2005-0094 CVE-2005-0095 CVE-2005-0096
CVE-2005-0097 CVE-2005-0173 CVE-2005-0174
CVE-2005-0175 CVE-2005-0194 CVE-2005-0211
CVE-2005-0241 CVE-2005-0446 CVE-2005-0626
CVE-2005-0718 CVE-2005-1345 CVE-1999-0710
CVE-2005-1519 CVE-2004-2479 CVE-2005-2794
CVE-2005-2796 CVE-2005-2917
---------------------------------------------------------------------
---------------------------------------------------------------------
1. Topic:
An updated Squid package that fixes several security issues is now
available.
Squid is a full-featured Web proxy cache.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
Fedora Core 2 - i386
3. Problem description:
A buffer overflow was found within the NTLM authentication helper
routine. If Squid is configured to use the NTLM authentication helper,
a remote attacker could potentially execute arbitrary code by sending a
lengthy password. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2004-0541 to this issue.
An out of bounds memory read bug was found within the NTLM
authentication helper routine. If Squid is configured to use the NTLM
authentication helper, a remote attacker could send a carefully crafted
NTLM authentication packet and cause Squid to crash. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0832 to this issue.
iDEFENSE reported a flaw in the squid SNMP module. This flaw could allow
an attacker who has the ability to send arbitrary packets to the SNMP
port to restart the server, causing it to drop all open connections. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0918 to this issue.
A buffer overflow flaw was found in the Gopher relay parser. This bug
could allow a remote Gopher server to crash the Squid proxy that reads
data from it. Although Gopher servers are now quite rare, a malicious
web page (for example) could redirect or contain a frame pointing to an
attacker's malicious gopher server. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-0094 to
this issue.
An integer overflow flaw was found in the WCCP message parser. It is
possible to crash the Squid server if an attacker is able to send a
malformed WCCP message with a spoofed source address matching Squid's
"home router". The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2005-0095 to this issue.
A memory leak was found in the NTLM fakeauth_auth helper. It is possible
that an attacker could place the Squid server under high load, causing
the NTML fakeauth_auth helper to consume a large amount of memory,
resulting in a denial of service. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-0096 to
this issue.
A NULL pointer de-reference bug was found in the NTLM fakeauth_auth
helper. It is possible for an attacker to send a malformed NTLM type 3
message, causing the Squid server to crash. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2005-0097 to this issue.
A username validation bug was found in squid_ldap_auth. It is possible
for a username to be padded with spaces, which could allow a user to
bypass explicit access control rules or confuse accounting. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2005-0173 to this issue.
The way Squid handles HTTP responses was found to need strengthening. It
is possible that a malicious web server could send a series of HTTP
responses in such a way that the Squid cache could be poisoned,
presenting users with incorrect webpages. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the names CVE-2005-0174
and CVE-2005-0175 to these issues.
When processing the configuration file, Squid parses empty Access
Control Lists (ACLs) and proxy_auth ACLs without defined auth schemes in
a way that effectively removes arguments, which could allow remote
attackers to bypass intended ACLs. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-0194 to
this issue.
A buffer overflow bug was found in the WCCP message parser. It is
possible that an attacker could send a malformed WCCP message which
could crash the Squid server or execute arbitrary code. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2005-0211 to this issue.
A bug was found in the way Squid handled oversized HTTP response
headers. It is possible that a malicious web server could send a
specially crafted HTTP header which could cause the Squid cache to be
poisoned, presenting users with incorrect webpages. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2005-0241 to this issue.
A bug was found in the way Squid handles FQDN lookups. It was possible
to crash the Squid server by sending a carefully crafted DNS response to
an FQDN lookup. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2005-0446 to this issue.
A race condition bug was found in the way Squid handles the now obsolete
Set-Cookie header. It is possible that Squid can leak Set-Cookie header
information to other clients connecting to Squid. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2005-0626 to this issue.
A bug was found in the way Squid handles PUT and POST requests. It is
possible for an authorised remote user to cause a failed PUT or POST
request which can cause Squid to crash. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-0718 to
this issue.
A bug was found in the way Squid processes errors in the access control
list. It is possible that an error in the access control list could give
users more access than intended. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-1345 to
this issue.
A bug was found in the way Squid handles access to the cachemgr.cgi
script. It is possible for an authorised remote user to bypass access
control lists with this flaw. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-1999-0710 to this
issue.
A bug was found in the way Squid handles DNS replies. If the port Squid
uses for DNS requests is not protected by a firewall it is possible for
a remote attacker to spoof DNS replies, possibly redirecting a user to
spoofed or malicious content. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2005-1519 to this
issue.
A bug was found in the way Squid displays error messages. A remote
attacker could submit a request containing an invalid hostname which
would result in Squid displaying a previously used error message. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-2479 to this issue.
Two denial of service bugs were found in the way Squid handles malformed
requests. A remote attacker could submit a specially crafted request to
Squid that would cause the server to crash. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the names
CVE-2005-2794 and CVE-2005-2796 to these issues.
A bug was found in the way Squid handles certain request sequences while
performing NTLM authentication. It is possible for an attacker to cause
Squid to crash. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2005-2917 to this issue.
Users of Squid should upgrade to this updated package, which contains
backported patches, and is not vulnerable to these issues.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which
are not installed but included in the list will not be updated. Note
that you can also use wildcards (*.rpm) if your current directory *only*
contains the desired RPMs.
Please note that this update is also available via yum and apt. Many
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.
5. Bug IDs fixed:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152809
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/squid-2.4.STABLE7-0.73.3.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/squid-2.4.STABLE7-0.73.3.legacy.i386.rpm
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/squid-2.5.STABLE1-9.10.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/squid-2.5.STABLE1-9.10.legacy.i386.rpm
Fedora Core 1:
SRPM:
http://download.fedoralegacy.org/fedora/1/updates/SRPMS/squid-2.5.STABLE3-2.fc1.6.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/1/updates/i386/squid-2.5.STABLE3-2.fc1.6.legacy.i386.rpm
Fedora Core 2:
SRPM:
http://download.fedoralegacy.org/fedora/2/updates/SRPMS/squid-2.5.STABLE9-1.FC2.4.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/2/updates/i386/squid-2.5.STABLE9-1.FC2.4.legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
---------------------------------------------------------------------
5db383926b0358e7b1a74cd0c84d3c253fae82a6
redhat/7.3/updates/i386/squid-2.4.STABLE7-0.73.3.legacy.i386.rpm
8d2b75252ee52b9fe943d4478960e30508bae4ea
redhat/7.3/updates/SRPMS/squid-2.4.STABLE7-0.73.3.legacy.src.rpm
d90f37a598d6789876d85fc41297fb6d6957711d
redhat/9/updates/i386/squid-2.5.STABLE1-9.10.legacy.i386.rpm
c6f5927ebca3000a5d9cb2d52912e9ea989ee8eb
redhat/9/updates/SRPMS/squid-2.5.STABLE1-9.10.legacy.src.rpm
4e1d0e1546e50f3f694617ce641b31230b3989ad
fedora/1/updates/i386/squid-2.5.STABLE3-2.fc1.6.legacy.i386.rpm
03e318f01302e6305d368349ea778ac9f104839d
fedora/1/updates/SRPMS/squid-2.5.STABLE3-2.fc1.6.legacy.src.rpm
9eb87b9c886d2c72d6ecefa3f70e016d65de9574
fedora/2/updates/i386/squid-2.5.STABLE9-1.FC2.4.legacy.i386.rpm
6aab32f2cb1e01196722d2ee6e980dc3915d788b
fedora/2/updates/SRPMS/squid-2.5.STABLE9-1.FC2.4.legacy.src.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is
available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0541
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0832
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0918
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0094
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0095
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0096
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0097
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0173
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0175
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0194
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0241
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0446
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0626
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1345
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1519
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2479
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2794
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2796
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2917
9. Contact:
The Fedora Legacy security contact is <secnotice@xxxxxxxxxxxxxxxx>. More
project details at http://www.fedoralegacy.org
---------------------------------------------------------------------
Attachment:
signature.asc
Description: OpenPGP digital signature