Date: Mon, 6 Aug 2001 09:57:07 -0600
From: Support Info <[email protected]>
To: [email protected], [email protected],
Subject: Security Update [CSSA-2001-029.0] Linux - Squid configuration problems
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
Caldera International, Inc. Security Advisory
Subject: Linux - Squid configuration problems
Advisory number: CSSA-2001-029.0
Issue date: 2001, August 06
Cross reference:
______________________________________________________________________________
1. Problem Description
There is a security problem with Squid, a proxy server shipped as part
of OpenLinux 3.1 Server. If Squid is configured for accelerator mode
(setting http_accel_with_proxy off), any request to Squid is allowed.
Malicious users may use your proxy to portscan remote systems, forge
email, and other activities.
2. Vulnerable Versions
System Package
-----------------------------------------------------------
OpenLinux 2.3 not vulnerable
OpenLinux eServer 2.3.1 not vulnerable
and OpenLinux eBuilder
OpenLinux eDesktop 2.4 not vulnerable
OpenLinux Server 3.1 All packages previous to
squid-2.4.STABLE1-7
OpenLinux Workstation 3.1 not vulnerable
3. Solution
Workaround
none
The proper solution is to upgrade to the latest packages.
4. OpenLinux 2.3
not vulnerable
5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0
not vulnerable
6. OpenLinux eDesktop 2.4
not vulnerable
7. OpenLinux 3.1 Server
7.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS
The corresponding source code package can be found at:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS
7.2 Verification
1779083edd38872f2ac15c219131d1ba RPMS/squid-2.4.STABLE1-7.i386.rpm
e5020ebf7aef60878139cdac81737212 SRPMS/squid-2.4.STABLE1-7.src.rpm
7.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fvh squid-2.4.STABLE1-7.i386.rpm
8. OpenLinux 3.1 Workstation
not vulnerable
9. References
This and other Caldera security resources are located at:
http://www.caldera.com/support/security/index.html
This security fix closes Caldera's internal Problem Report 10294.
10. Disclaimer
Caldera International, Inc. is not responsible for the misuse of
any of the information we provide on this website and/or through our
security advisories. Our advisories are a service to our customers
intended to promote secure installation and use of Caldera OpenLinux.
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE7bo4N18sy83A/qfwRAgeNAJ9En4ytBnxpwtNz+VDAJthRA+MC2wCfS0fi
k5aqw6UmMAloEu5Pp62xQBQ=
=84hX
-----END PGP SIGNATURE-----
