Exploit the possiblities

Mandriva Linux Security Advisory 2013-013

Mandriva Linux Security Advisory 2013-013
Posted Feb 20, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-013 - Multiple vulnerabilities has been found and corrected in Squid. Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via long POST requests, or crafted authentication credentials. cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service via a crafted request. NOTE: this issue is due to an incorrect fix for possibly involving an incorrect order of arguments or incorrect comparison. The updated packages have been patched to correct these issues.

tags | advisory, remote, denial of service, cgi, vulnerability, memory leak
systems | linux, mandriva
advisories | CVE-2012-5643, CVE-2013-0189
MD5 | 9f86798b70ae1edecb246a190dcbbeb8

Mandriva Linux Security Advisory 2013-013

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:013
http://www.mandriva.com/security/
_______________________________________________________________________

Package : squid
Date : February 20, 2013
Affected: 2011., Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been found and corrected in squid
(cachemgr.cgi):

Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid
2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before
3.3.0.2 allow remote attackers to cause a denial of service (memory
consumption) via (1) invalid Content-Length headers, (2) long POST
requests, or (3) crafted authentication credentials (CVE-2012-5643).

cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and
other versions, allows remote attackers to cause a denial of service
(resource consumption) via a crafted request. NOTE: this issue is
due to an incorrect fix for CVE-2012-5643, possibly involving an
incorrect order of arguments or incorrect comparison (CVE-2013-0189).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5643
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0189
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2011:
be6b1b58b23adf78655e154a0d9b4425 2011/i586/squid-3.1.15-1.3-mdv2011.0.i586.rpm
87d5c4f17ec9609a6c23bde3254f1607 2011/i586/squid-cachemgr-3.1.15-1.3-mdv2011.0.i586.rpm
defcc1655b36cb5708f281311d6f14e5 2011/SRPMS/squid-3.1.15-1.3.src.rpm

Mandriva Linux 2011/X86_64:
47252ced15dc7132ccc49db09f211507 2011/x86_64/squid-3.1.15-1.3-mdv2011.0.x86_64.rpm
b2cc7e05622308c13826397b9e9920c3 2011/x86_64/squid-cachemgr-3.1.15-1.3-mdv2011.0.x86_64.rpm
defcc1655b36cb5708f281311d6f14e5 2011/SRPMS/squid-3.1.15-1.3.src.rpm

Mandriva Enterprise Server 5:
951ed0c1ac4f41a20fa668602d9527b2 mes5/i586/squid-3.0-22.6mdvmes5.2.i586.rpm
480f84eb3ec2d8edef1f30d849add394 mes5/i586/squid-cachemgr-3.0-22.6mdvmes5.2.i586.rpm
882f87c2db26259b5f1c7600cde80196 mes5/SRPMS/squid-3.0-22.6mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
816be462b15ab4aeb3304c8f40cdf7a7 mes5/x86_64/squid-3.0-22.6mdvmes5.2.x86_64.rpm
71654b5c9dfe52d184c5ea535db5b4b4 mes5/x86_64/squid-cachemgr-3.0-22.6mdvmes5.2.x86_64.rpm
882f87c2db26259b5f1c7600cde80196 mes5/SRPMS/squid-3.0-22.6mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFRJKaMmqjQ0CJFipgRAqXZAJ9/daTMtTTbwS557KYt3l7GU0QvxwCeJwk6
uYvOYSvVhXV6LILM7700ex0=
=QCol
-----END PGP SIGNATURE-----


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

January 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    16 Files
  • 4
    Jan 4th
    39 Files
  • 5
    Jan 5th
    26 Files
  • 6
    Jan 6th
    40 Files
  • 7
    Jan 7th
    2 Files
  • 8
    Jan 8th
    16 Files
  • 9
    Jan 9th
    25 Files
  • 10
    Jan 10th
    28 Files
  • 11
    Jan 11th
    44 Files
  • 12
    Jan 12th
    32 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    4 Files
  • 15
    Jan 15th
    31 Files
  • 16
    Jan 16th
    15 Files
  • 17
    Jan 17th
    16 Files
  • 18
    Jan 18th
    24 Files
  • 19
    Jan 19th
    7 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close