[USN-601-1] Squid vulnerability
Date: Mon, 14 Apr 2008 16:32:21 -0400
From: Jamie Strandboge <jamie@canonical.com.>
To: [email protected]
Subject: [USN-601-1] Squid vulnerability
Message-ID: <20080414203221.GD13373@severus.strandboge.com.>
Reply-To: Jamie Strandboge <jamie@canonical.com.>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="0IvGJv3f9h+YhkrH"
Content-Disposition: inline
User-Agent: Mutt/1.5.17+20080114 (2008-01-14)
X-Virus-Scanned: antivirus-gw at tyumen.ru
--0IvGJv3f9h+YhkrH
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=20
Ubuntu Security Notice USN-601-1 April 14, 2008
squid vulnerability
CVE-2008-1612
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 6.10
Ubuntu 7.04
Ubuntu 7.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
squid 2.5.12-4ubuntu2.4
Ubuntu 6.10:
squid 2.6.1-3ubuntu1.7
Ubuntu 7.04:
squid 2.6.5-4ubuntu2.2
Ubuntu 7.10:
squid 2.6.14-1ubuntu2.2
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
It was discovered that Squid did not perform proper bounds checking when
processing cache update replies. A remote authenticated user may be able
to trigger an assertion error and cause a denial of service. This
vulnerability is due to an incorrect fix for CVE-2007-6239.
(CVE-2008-1612)
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubunt=
u2.4.diff.gz
Size/MD5: 247667 05b709ab6c6ced664fca3eb8c8534e20
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubunt=
u2.4.dsc
Size/MD5: 666 7da288841f7d6c6f8c662a389ecc334e
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12.orig.t=
ar.gz
Size/MD5: 1407261 1fc92afd1e858a51a2ebeba28cb76656
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid-common_2.5.12=
-4ubuntu2.4_all.deb
Size/MD5: 203332 269c6ad6ebe5541d0b8880dfa305d56c
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubunt=
u2.4_amd64.deb
Size/MD5: 844138 8281589e7f42bb8aabd0a72f5bc2878d
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.1=
2-4ubuntu2.4_amd64.deb
Size/MD5: 106032 d631e04e0b10217ca8fd38a52a67d89a
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5=
=2E12-4ubuntu2.4_amd64.deb
Size/MD5: 79522 e81158cf4b36e69daacd77c58ce8faab
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubunt=
u2.4_i386.deb
Size/MD5: 756536 c347c37b1d33310600d2cd19a5e1b81d
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.1=
2-4ubuntu2.4_i386.deb
Size/MD5: 104858 e0ca641be3aa8770de87b80c9768b7ae
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5=
=2E12-4ubuntu2.4_i386.deb
Size/MD5: 78366 7dc911b739fbe19027d29f8be6c783c0
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubunt=
u2.4_powerpc.deb
Size/MD5: 839094 adbe397722a3fa1ea87b99f69ae7be72
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.1=
2-4ubuntu2.4_powerpc.deb
Size/MD5: 105728 7507a0e891242e490224be0a7e295a5c
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5=
=2E12-4ubuntu2.4_powerpc.deb
Size/MD5: 79486 b9d7a13662462d2ea26bdee58d573861
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubunt=
u2.4_sparc.deb
Size/MD5: 793280 3b06b5c2728ff2147f1b947b1d028a3c
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.1=
2-4ubuntu2.4_sparc.deb
Size/MD5: 105222 00abda35533fc22f7737856aa6f2172a
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5=
=2E12-4ubuntu2.4_sparc.deb
Size/MD5: 79440 6a8bb2ec68388f78fee19e5a2dd4ebdf
Updated packages for Ubuntu 6.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu=
1.7.diff.gz
Size/MD5: 254763 e252c8c8e082a2ef7065ff3f8f3ff36f
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu=
1.7.dsc
Size/MD5: 675 d2c24e9244d97f58302a21546a25c05d
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1.orig.ta=
r.gz
Size/MD5: 1593236 5035d9cc90e8033e4eac232ce19a665f
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid-common_2.6.1-=
3ubuntu1.7_all.deb
Size/MD5: 416084 f350b81af9e81420b2350355bebd67b5
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu=
1.7_amd64.deb
Size/MD5: 678474 6ff5a19ddaf92102684ffd6fbe9caa36
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1=
-3ubuntu1.7_amd64.deb
Size/MD5: 109704 fd64d9866b244bfc50c772d1b84dbe39
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E1-3ubuntu1.7_amd64.deb
Size/MD5: 82224 29594209f52225b09efc32165ebd467c
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu=
1.7_i386.deb
Size/MD5: 609784 207b76849162076880cf7df035c95ccf
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1=
-3ubuntu1.7_i386.deb
Size/MD5: 108892 b187fe59f11f43ba6eb1902c8b2194ed
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E1-3ubuntu1.7_i386.deb
Size/MD5: 81472 c9716d90bc7e66c036886e3c75b446c5
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu=
1.7_powerpc.deb
Size/MD5: 683660 ae0e97423560b371aed4e7e9f7734f6f
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1=
-3ubuntu1.7_powerpc.deb
Size/MD5: 109538 80025cfae7d7863ba238f108777fb1b2
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E1-3ubuntu1.7_powerpc.deb
Size/MD5: 82158 cafc6835a4ae8200ae9d3aa7b2b6e0d9
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu=
1.7_sparc.deb
Size/MD5: 636180 0db7e64eb2588415504105f4fa475365
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1=
-3ubuntu1.7_sparc.deb
Size/MD5: 109162 44abc1d0e94368383e8261d6d313637e
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E1-3ubuntu1.7_sparc.deb
Size/MD5: 82522 b4c666024a9747ed8535c47b184512ce
Updated packages for Ubuntu 7.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.5-4ubuntu=
2.2.diff.gz
Size/MD5: 272337 f6744cf3f7ae32628290b9bd68ba813e
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.5-4ubuntu=
2.2.dsc
Size/MD5: 761 736b606ac1afec4657c8516a125595ad
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.5.orig.ta=
r.gz
Size/MD5: 1636886 26cc918028340dc8ceb9c0c4b988d717
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid-common_2.6.5-=
4ubuntu2.2_all.deb
Size/MD5: 437594 aeeba77731882cd06e97134d4e371b37
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.5-4ubuntu=
2.2_amd64.deb
Size/MD5: 712118 a29a8669bac579cf09684f8a12364566
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.5=
-4ubuntu2.2_amd64.deb
Size/MD5: 116484 047a2c8738e284bb32aae31023067546
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E5-4ubuntu2.2_amd64.deb
Size/MD5: 86868 12a12ea3ed545db8ed233c6ad33540df
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.5-4ubuntu=
2.2_i386.deb
Size/MD5: 640774 519724b3e19e271dac2ae8ad67b4e58a
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.5=
-4ubuntu2.2_i386.deb
Size/MD5: 115722 f6237a5cd5975ac7fefe1a06b7eff7c7
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E5-4ubuntu2.2_i386.deb
Size/MD5: 86098 4389e8dc194f6a51db84e9a66e9d41a8
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.5-4ubuntu=
2.2_powerpc.deb
Size/MD5: 728496 7be7c056bb9aa0193939290f7e75ce12
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.5=
-4ubuntu2.2_powerpc.deb
Size/MD5: 117040 09b95d8fa9396fa2e0fc5674cd503d2b
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E5-4ubuntu2.2_powerpc.deb
Size/MD5: 87488 9ea28189672205a5b92d8112bc1d5abc
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.5-4ubuntu=
2.2_sparc.deb
Size/MD5: 674020 33b1d5e27e08fd1f8b127d9c01b842ca
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.5=
-4ubuntu2.2_sparc.deb
Size/MD5: 116282 289c107a2dfb603f030964105a112f21
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E5-4ubuntu2.2_sparc.deb
Size/MD5: 87454 4cb551b49cb85d08c9d6b9803609dcb7
Updated packages for Ubuntu 7.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.14-1ubunt=
u2.2.diff.gz
Size/MD5: 301024 490e4025cd800e69eeb15f43ffe0fbae
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.14-1ubunt=
u2.2.dsc
Size/MD5: 764 badd1f8b8cc0c40a8e7db4e5710b0d72
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.14.orig.t=
ar.gz
Size/MD5: 1694713 25a0e4d4b9e673b24c29901bbfbcdb5c
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid-common_2.6.14=
-1ubuntu2.2_all.deb
Size/MD5: 474092 f47722cbc00c6491494570ce4831bf02
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.14-1ubunt=
u2.2_amd64.deb
Size/MD5: 715456 df3ce48f7a04eaa62ae2b5ee7f47faa6
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1=
4-1ubuntu2.2_amd64.deb
Size/MD5: 111758 49f1243ec4ee3c8667e95ff693dc8157
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E14-1ubuntu2.2_amd64.deb
Size/MD5: 91990 7d0c2b0050f13f82cb6fac205ad1b02b
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.14-1ubunt=
u2.2_i386.deb
Size/MD5: 642572 a8b62680d53fb8fb1a89def6ab235624
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1=
4-1ubuntu2.2_i386.deb
Size/MD5: 110902 95debb69cfae20349ad47e86d8e72f28
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E14-1ubuntu2.2_i386.deb
Size/MD5: 91178 fe55bbb3019ea9d56237f0a0d3ad5802
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.14-1ubunt=
u2.2_powerpc.deb
Size/MD5: 728072 3bdfbec516b9a6d4f2038a97537952dd
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1=
4-1ubuntu2.2_powerpc.deb
Size/MD5: 112406 762f797a0ecb887188dd9b22d923da0b
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E14-1ubuntu2.2_powerpc.deb
Size/MD5: 92538 1aeee23bfed61a3d206b6e3825db74fb
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.14-1ubunt=
u2.2_sparc.deb
Size/MD5: 675466 c536f56f80a177a1cc546b813fbe95fd
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1=
4-1ubuntu2.2_sparc.deb
Size/MD5: 111600 57f390b1637d8457e5675fbe0acea928
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6=
=2E14-1ubuntu2.2_sparc.deb
Size/MD5: 92548 49e901c305196336ab6021838a9ec0fd
--0IvGJv3f9h+YhkrH
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFIA79VW0JvuRdL8BoRAs5tAJ9Y2vyXpppJPWKairWkhfVRfZHMGACfRSmY
pnvffb8qnLHErFAyCJfubzA=
=x3LL
-----END PGP SIGNATURE-----
--0IvGJv3f9h+YhkrH--
