exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2013-013

Mandriva Linux Security Advisory 2013-013
Posted Feb 20, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-013 - Multiple vulnerabilities has been found and corrected in Squid. Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via long POST requests, or crafted authentication credentials. cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service via a crafted request. NOTE: this issue is due to an incorrect fix for possibly involving an incorrect order of arguments or incorrect comparison. The updated packages have been patched to correct these issues.

tags | advisory, remote, denial of service, cgi, vulnerability, memory leak
systems | linux, mandriva
advisories | CVE-2012-5643, CVE-2013-0189
SHA-256 | 5d5f69e81a32849b1999089a698c6a5586a8a41760ae2ffa2fdbb0728609733f

Mandriva Linux Security Advisory 2013-013

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:013
http://www.mandriva.com/security/
_______________________________________________________________________

Package : squid
Date : February 20, 2013
Affected: 2011., Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been found and corrected in squid
(cachemgr.cgi):

Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid
2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before
3.3.0.2 allow remote attackers to cause a denial of service (memory
consumption) via (1) invalid Content-Length headers, (2) long POST
requests, or (3) crafted authentication credentials (CVE-2012-5643).

cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and
other versions, allows remote attackers to cause a denial of service
(resource consumption) via a crafted request. NOTE: this issue is
due to an incorrect fix for CVE-2012-5643, possibly involving an
incorrect order of arguments or incorrect comparison (CVE-2013-0189).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5643
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0189
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2011:
be6b1b58b23adf78655e154a0d9b4425 2011/i586/squid-3.1.15-1.3-mdv2011.0.i586.rpm
87d5c4f17ec9609a6c23bde3254f1607 2011/i586/squid-cachemgr-3.1.15-1.3-mdv2011.0.i586.rpm
defcc1655b36cb5708f281311d6f14e5 2011/SRPMS/squid-3.1.15-1.3.src.rpm

Mandriva Linux 2011/X86_64:
47252ced15dc7132ccc49db09f211507 2011/x86_64/squid-3.1.15-1.3-mdv2011.0.x86_64.rpm
b2cc7e05622308c13826397b9e9920c3 2011/x86_64/squid-cachemgr-3.1.15-1.3-mdv2011.0.x86_64.rpm
defcc1655b36cb5708f281311d6f14e5 2011/SRPMS/squid-3.1.15-1.3.src.rpm

Mandriva Enterprise Server 5:
951ed0c1ac4f41a20fa668602d9527b2 mes5/i586/squid-3.0-22.6mdvmes5.2.i586.rpm
480f84eb3ec2d8edef1f30d849add394 mes5/i586/squid-cachemgr-3.0-22.6mdvmes5.2.i586.rpm
882f87c2db26259b5f1c7600cde80196 mes5/SRPMS/squid-3.0-22.6mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
816be462b15ab4aeb3304c8f40cdf7a7 mes5/x86_64/squid-3.0-22.6mdvmes5.2.x86_64.rpm
71654b5c9dfe52d184c5ea535db5b4b4 mes5/x86_64/squid-cachemgr-3.0-22.6mdvmes5.2.x86_64.rpm
882f87c2db26259b5f1c7600cde80196 mes5/SRPMS/squid-3.0-22.6mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFRJKaMmqjQ0CJFipgRAqXZAJ9/daTMtTTbwS557KYt3l7GU0QvxwCeJwk6
uYvOYSvVhXV6LILM7700ex0=
=QCol
-----END PGP SIGNATURE-----


Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    21 Files
  • 17
    Sep 17th
    51 Files
  • 18
    Sep 18th
    23 Files
  • 19
    Sep 19th
    48 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close