A squid security update is available for Red Hat Enterprise Linux 2.1
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Low: squid security update
Advisory ID: RHSA-2005:489-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-489.html
Issue date: 2005-06-13
Updated on: 2005-06-13
Product: Red Hat Enterprise Linux
CVE Names: CVE-1999-0710 CAN-2005-0718 CAN-2005-1519
----------------------------------------------------------------------
1. Summary:
An updated squid package that fixes several security issues is now available.
This update has been rated as having low security impact by the Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
3. Problem description:
Squid is a full-featured Web proxy cache.
A bug was found in the way Squid handles PUT and POST requests. It is possible for an authorised remote user to cause a failed PUT or POST request which can cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0718 to this issue.
A bug was found in the way Squid handles access to the cachemgr.cgi script. It is possible for an authorised remote user to bypass access control lists with this flaw. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-0710 to this issue.
A bug was found in the way Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall, it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1519 to this issue.
Additionally, this update fixes the following bugs:
- squid fails in the unpacking of squid-2.4.STABLE7-1.21as.5.src.rpm
Users of Squid should upgrade to this updated package, which contains backported patches to correct these issues.
4. Solution:
Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
125007 - insecure permissions for squid.conf
151423 - CAN-2005-0718 Segmentation fault on failed PUT/POST request
153960 - It fails in the unpacking of squid-2.4.STABLE7-1.21as.5.src.rpm
156161 - CVE-1999-0710 cachemgr.cgi access control bypass
157455 - CAN-2005-1519 DNS lookups unreliable on untrusted networks
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/squid-2.4.STABLE7-1.21as.8.src.rpm
94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm
i386:
08c0d416b59e426120c9f7932e974f9d squid-2.4.STABLE7-1.21as.8.i386.rpm
ia64:
9e15091928dd05b3f8dcf9f2285bd608 squid-2.4.STABLE7-1.21as.8.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/squid-2.4.STABLE7-1.21as.8.src.rpm
94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm
ia64:
9e15091928dd05b3f8dcf9f2285bd608 squid-2.4.STABLE7-1.21as.8.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/squid-2.4.STABLE7-1.21as.8.src.rpm
94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm
i386:
08c0d416b59e426120c9f7932e974f9d squid-2.4.STABLE7-1.21as.8.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1519
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Low: squid security update
Advisory ID: RHSA-2005:489-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-489.html
Issue date: 2005-06-13
Updated on: 2005-06-13
Product: Red Hat Enterprise Linux
CVE Names: CVE-1999-0710 CAN-2005-0718 CAN-2005-1519
----------------------------------------------------------------------
1. Summary:
An updated squid package that fixes several security issues is now available.
This update has been rated as having low security impact by the Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
3. Problem description:
Squid is a full-featured Web proxy cache.
A bug was found in the way Squid handles PUT and POST requests. It is possible for an authorised remote user to cause a failed PUT or POST request which can cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0718 to this issue.
A bug was found in the way Squid handles access to the cachemgr.cgi script. It is possible for an authorised remote user to bypass access control lists with this flaw. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-0710 to this issue.
A bug was found in the way Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall, it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1519 to this issue.
Additionally, this update fixes the following bugs:
- squid fails in the unpacking of squid-2.4.STABLE7-1.21as.5.src.rpm
Users of Squid should upgrade to this updated package, which contains backported patches to correct these issues.
4. Solution:
Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
125007 - insecure permissions for squid.conf
151423 - CAN-2005-0718 Segmentation fault on failed PUT/POST request
153960 - It fails in the unpacking of squid-2.4.STABLE7-1.21as.5.src.rpm
156161 - CVE-1999-0710 cachemgr.cgi access control bypass
157455 - CAN-2005-1519 DNS lookups unreliable on untrusted networks
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/squid-2.4.STABLE7-1.21as.8.src.rpm
94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm
i386:
08c0d416b59e426120c9f7932e974f9d squid-2.4.STABLE7-1.21as.8.i386.rpm
ia64:
9e15091928dd05b3f8dcf9f2285bd608 squid-2.4.STABLE7-1.21as.8.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/squid-2.4.STABLE7-1.21as.8.src.rpm
94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm
ia64:
9e15091928dd05b3f8dcf9f2285bd608 squid-2.4.STABLE7-1.21as.8.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/squid-2.4.STABLE7-1.21as.8.src.rpm
94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm
i386:
08c0d416b59e426120c9f7932e974f9d squid-2.4.STABLE7-1.21as.8.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1519
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
