[USN-414-1] Squid vulnerabilities

Kees Cook kees at ubuntu.com
Thu Jan 25 00:08:54 UTC 2007 

=========================================================== 
Ubuntu Security Notice USN-414-1           January 24, 2007
squid vulnerabilities
CVE-2007-0247, CVE-2007-0248
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 6.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  squid                                    2.5.12-4ubuntu2.2

Ubuntu 6.10:
  squid                                    2.6.1-3ubuntu1.2

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

David Duncan Ross Palmer and Henrik Nordstrom discovered that squid 
incorrectly handled special characters in FTP URLs.  Remote users with 
access to squid could crash the server leading to a denial of service. 
(CVE-2007-0247)

Erick Dantas Rotole and Henrik Nordstrom discovered that squid could end 
up in an endless loop when exhausted of available external ACL helpers.  
Remote users with access to squid could cause CPU starvation, possibly 
leading to a denial of service.  This does not affect a default Ubuntu 
installation, since external ACL helpers must be configured and used.
(CVE-2007-0248)


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubuntu2.2.diff.gz
      Size/MD5:   247162 c77eda0d1ab1a685ddccba3cec11112a
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubuntu2.2.dsc
      Size/MD5:      666 728df6474a1a90b654f8e7068d49c4eb
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12.orig.tar.gz
      Size/MD5:  1407261 1fc92afd1e858a51a2ebeba28cb76656

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid-common_2.5.12-4ubuntu2.2_all.deb
      Size/MD5:   203104 31807d0c54820bcb4ccaac324fd8ccb2

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.12-4ubuntu2.2_amd64.deb
      Size/MD5:   105858 ec1034625a294cd9a5aee3acd367e8e6
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubuntu2.2_amd64.deb
      Size/MD5:   843664 1fba5697e70517003303a1edc4fb91f9
    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5.12-4ubuntu2.2_amd64.deb
      Size/MD5:    79354 2967f6690585721a640fbfde495a0fee

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.12-4ubuntu2.2_i386.deb
      Size/MD5:   104692 bf432d8afaab042920e20d5f0fa48587
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubuntu2.2_i386.deb
      Size/MD5:   756304 333887def26d690a1b40e06b1d6e9238
    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5.12-4ubuntu2.2_i386.deb
      Size/MD5:    78198 d69eeb3c5f4bbb0c393c83292b95054b

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.12-4ubuntu2.2_powerpc.deb
      Size/MD5:   105550 add8f17581b0eba4254c9a78ecf20d6d
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubuntu2.2_powerpc.deb
      Size/MD5:   838728 65488fafc44d1cbbeb54507734395c3a
    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5.12-4ubuntu2.2_powerpc.deb
      Size/MD5:    79318 cd24525894b43ae769f00286412f6a8d

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.12-4ubuntu2.2_sparc.deb
      Size/MD5:   105074 95fa08d5f9a710a12331ffee2fe411da
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.12-4ubuntu2.2_sparc.deb
      Size/MD5:   793020 0b11d30e1704e3ad6eb939494fe46ae8
    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5.12-4ubuntu2.2_sparc.deb
      Size/MD5:    79270 e7b4ab8c0b0939491c3ff37b0736278c

Updated packages for Ubuntu 6.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu1.2.diff.gz
      Size/MD5:   250552 c7b1b1b80935e2e9e916bc5e6c1d72a1
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu1.2.dsc
      Size/MD5:      675 cf59b558d3ec2f05fb5641a8eda9627d
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1.orig.tar.gz
      Size/MD5:  1593236 5035d9cc90e8033e4eac232ce19a665f

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid-common_2.6.1-3ubuntu1.2_all.deb
      Size/MD5:   415546 c59977fd127de425cbeb794dc0c9a460

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1-3ubuntu1.2_amd64.deb
      Size/MD5:   109386 b94595843390e1aa91893fa7a434c7ca
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu1.2_amd64.deb
      Size/MD5:   678296 06f5d5d9256b4e2b3cb48670578de871
    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6.1-3ubuntu1.2_amd64.deb
      Size/MD5:    81912 24c3e805cb5b54b2e52abd1841edc2ac

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1-3ubuntu1.2_i386.deb
      Size/MD5:   108574 dea247ae92905bf3c719fba29828f529
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu1.2_i386.deb
      Size/MD5:   609266 bae451ceb73a4af381be40cfb7e189a8
    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6.1-3ubuntu1.2_i386.deb
      Size/MD5:    81162 573bbe0fe45ee1f1934847ef63a8d795

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1-3ubuntu1.2_powerpc.deb
      Size/MD5:   109218 d17878220e84e6c0b12b4b32c725b37a
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu1.2_powerpc.deb
      Size/MD5:   683080 b7d8bf18b2c5db3ac208cb5d545ac55a
    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6.1-3ubuntu1.2_powerpc.deb
      Size/MD5:    81844 21ebbc9fcdd89b53a8791b1387cc4c0f

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.6.1-3ubuntu1.2_sparc.deb
      Size/MD5:   108836 7f183a3aebc766b479b0a358360c9a20
    http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.6.1-3ubuntu1.2_sparc.deb
      Size/MD5:   635690 c87a766ec1c84ddddb8014fc79bd0956
    http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.6.1-3ubuntu1.2_sparc.deb
      Size/MD5:    82210 9b06dd8cf1597cceb64cbe46a1f0f46f

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20070124/bb61d4f7/attachment.sig>

More information about the ubuntu-security-announce mailing list