Subject: [yellowdog-updates] Yellow Dog Linux Security Advisory: YDL-20020305-1
dburcaw@newhope.terraplex.com
Date: Tue Mar 05 2002 - 04:07:15 MST
Yellow Dog Linux Security Announcement
--------------------------------------
Package: squid
Issue Date: March 05, 2002
Priority: high
Advisory ID: YDU-20020305-2
1. Topic:
New squid packages are available that fix many
vulnerabilities including a denial of service (DoS)
attack.
2. Problem:
"Squid is a high-performance proxy caching server. Various security issues
have been found in Squid up to and including version 2.4.STABLE2. These were:
- a memory leak in the SNMP code
- a crash on specially-formatted data in FTP URL parsing
- HTCP would still be active, even if it was disabled in the config file
These errata pacakges contain Squid version 2.4.STABLE3, which is not
vulnerable to these issues. It is recommended that all users of Squid
update to the fixed packages.
Note: SNMP support is disabled in the
default configuration of these packages (it was previously enabled).
If you need SNMP support, edit your squid configuration and change
the 'snmp_port' option; the default port for SNMP enabled-squid is
3401.
Thanks go to Jouko Pynnonen for notifying us of the FTP vulnerability and
to the Squid team for providing patches.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CAN-2002-0067, CAN-2002-0068, CAN-2002-0069 to these issues."
(from Red Hat's advisory)
3. Solution:
a) Updating via yup...
We suggest that you use the Yellow Dog Update Program (yup)
to keep your system up-to-date. The following command(s) will
automatically retrieve and install the fixed version of
this update onto your system:
yup update squid
b) Updating manually...
The update can also be retrieved manually from our ftp site
below along with the rpm command that should be used to install
the update. (Please use a mirror site)
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.1/ppc/
rpm -Fvh squid-2.4.STABLE3-1.7.0.ppc.rpm
4. Verification
MD5 checksum Package
-------------------------------- ----------------------------
6f8f7c0c790de090b1a33ad08834f489 ppc/squid-2.4.STABLE3-1.7.0.ppc.rpm
f41382375ab6a8002c6fd4de08ba2af0 SRPMS/squid-2.4.STABLE3-1.7.0.src.rpm
If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename
5. Misc.
Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.
For information regarding the usage of yup, the Yellow Dog Update Program, see
http://http://www.yellowdoglinux.com/support/solutions/ydl_general/yup.shtml
This archive was generated by hypermail 2a24 : Tue Mar 05 2002 - 13:56:43 MST