Advisories

Mandriva Advisories

Package name squid Date October 26th, 2005 Advisory ID MDKSA-2005:195 Affected versions 10.1, CS2.1, CS3.0, MNF2.0, 10.2, 2006.0 Synopsis Updated squid packages fix vulnerabilities

Problem Description

The rfc1738_do_escape function in ftp.c for Squid 2.5.STABLE11 and
earlier allows remote FTP servers to cause a denial of service
(segmentation fault) via certain "odd" responses.

The updated packages have been patched to address these issues.

Updated Packages

Mandrakelinux 10.1

 1aa5389665eb7c44fc1a6f2a62a9c3e4  10.1/RPMS/squid-2.5.STABLE9-1.5.101mdk.i586.rpm
 9000867a2ad94d095311053f36742abc  10.1/SRPMS/squid-2.5.STABLE9-1.5.101mdk.src.rpm

Mandrakelinux 10.1/X86_64

 d417b0a933c81eeee4462ff5bf0d207a  x86_64/10.1/RPMS/squid-2.5.STABLE9-1.5.101mdk.x86_64.rpm
 9000867a2ad94d095311053f36742abc  x86_64/10.1/SRPMS/squid-2.5.STABLE9-1.5.101mdk.src.rpm

Corporate Server 2.1

 f8aca99b670bd1d7cd062d29d6e337c0  corporate/2.1/RPMS/squid-2.4.STABLE7-2.10.C21mdk.i586.rpm
 575ebbe6d8c6dd4a88c85763de0955a6  corporate/2.1/SRPMS/squid-2.4.STABLE7-2.10.C21mdk.src.rpm

Corporate Server 2.1/X86_64

 b2bb3b18fbaec34fa4a4de306f7badfa  x86_64/corporate/2.1/RPMS/squid-2.4.STABLE7-2.10.C21mdk.x86_64.rpm
 575ebbe6d8c6dd4a88c85763de0955a6  x86_64/corporate/2.1/SRPMS/squid-2.4.STABLE7-2.10.C21mdk.src.rpm

Corporate Server 3.0

 16a31934c2801715f0cb6290ea1c5c58  corporate/3.0/RPMS/squid-2.5.STABLE9-1.5.C30mdk.i586.rpm
 aa1042be761e422dbee47cf3b5777b90  corporate/3.0/SRPMS/squid-2.5.STABLE9-1.5.C30mdk.src.rpm

Corporate Server 3.0/X86_64

 5c285a1e0df7c5de08424a73438ef094  x86_64/corporate/3.0/RPMS/squid-2.5.STABLE9-1.5.C30mdk.x86_64.rpm
 aa1042be761e422dbee47cf3b5777b90  x86_64/corporate/3.0/SRPMS/squid-2.5.STABLE9-1.5.C30mdk.src.rpm

Multi Network Firewall 2.0

 92a195660ac40c9b6ae9ca275054c501  mnf/2.0/RPMS/squid-2.5.STABLE9-1.5.M20mdk.i586.rpm
 1a97bb3873323ffe64629623c72d28c8  mnf/2.0/SRPMS/squid-2.5.STABLE9-1.5.M20mdk.src.rpm

Mandriva Linux LE2005

 442d8df682a4b46ae9f1c2e864b6505d  10.2/RPMS/squid-2.5.STABLE9-1.5.102mdk.i586.rpm
 bd75db1db5949be45168118bf9fd6e80  10.2/SRPMS/squid-2.5.STABLE9-1.5.102mdk.src.rpm

Mandriva Linux LE2005/X86_64

 08dcae009d962753884eb5c11ff1bdf3  x86_64/10.2/RPMS/squid-2.5.STABLE9-1.5.102mdk.x86_64.rpm
 bd75db1db5949be45168118bf9fd6e80  x86_64/10.2/SRPMS/squid-2.5.STABLE9-1.5.102mdk.src.rpm

Mandriva Linux 2006

 6c8f78eaefa702ea819c53cab55ad715  2006.0/RPMS/squid-2.5.STABLE10-10.2.20060mdk.i586.rpm
 0b213d4496b8db93581a2b21388900af  2006.0/RPMS/squid-cachemgr-2.5.STABLE10-10.2.20060mdk.i586.rpm
 1a242f5c868a63decda6a14c18de0397  2006.0/SRPMS/squid-2.5.STABLE10-10.2.20060mdk.src.rpm

Mandriva Linux 2006/X86_64

 a8a30856a40f1067790ffb816c15ae4a  x86_64/2006.0/RPMS/squid-2.5.STABLE10-10.2.20060mdk.x86_64.rpm
 7bbf70c2cbe5e22f6a5d9008ca96a887  x86_64/2006.0/RPMS/squid-cachemgr-2.5.STABLE10-10.2.20060mdk.x86_64.rpm
 1a242f5c868a63decda6a14c18de0397  x86_64/2006.0/SRPMS/squid-2.5.STABLE10-10.2.20060mdk.src.rpm

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3258

Upgrade

To upgrade automatically, use MandrivaUpdate.

Verification

Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

                rpm --checksig package.rpm
                

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.