exploit the possibilities

Mandriva Linux Security Advisory 2009-241

Mandriva Linux Security Advisory 2009-241
Posted Jan 11, 2010
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2009-241 - The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function. This update provides a solution to this vulnerability. Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

tags | advisory, remote, denial of service
systems | linux, mandriva
advisories | CVE-2009-2855
MD5 | f4986b8ff810c1562933be0272c2e575

Mandriva Linux Security Advisory 2009-241

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2009:241-1
http://www.mandriva.com/security/
_______________________________________________________________________

Package : squid
Date : January 11, 2010
Affected: 2008.0
_______________________________________________________________________

Problem Description:

A vulnerability was discovered and corrected in squid:

The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7
allows remote attackers to cause a denial of service via a crafted
auth header with certain comma delimiters that trigger an infinite
loop of calls to the strcspn function (CVE-2009-2855).

This update provides a solution to this vulnerability.

Update:

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2855
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2008.0:
e4c9373aabe23a99038535933cadfcdf 2008.0/i586/squid-2.6.STABLE16-1.4mdv2008.0.i586.rpm
264a75acfe38304d56f246ced43c0b77 2008.0/i586/squid-cachemgr-2.6.STABLE16-1.4mdv2008.0.i586.rpm
c5cb0059c20cf425ae1eb5320fb88d9a 2008.0/SRPMS/squid-2.6.STABLE16-1.4mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
736aebebdae4217c764a3a27d352f162 2008.0/x86_64/squid-2.6.STABLE16-1.4mdv2008.0.x86_64.rpm
bac27002220cdbe610a1dc5cfb249603 2008.0/x86_64/squid-cachemgr-2.6.STABLE16-1.4mdv2008.0.x86_64.rpm
c5cb0059c20cf425ae1eb5320fb88d9a 2008.0/SRPMS/squid-2.6.STABLE16-1.4mdv2008.0.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLS16KmqjQ0CJFipgRAtkWAJ41RYElygKvE+mNiEahH9mrolMmSgCfc+LZ
PPkZg8mJLqu1BaIf56PCYiU=
=E+fE
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    28 Files
  • 2
    Nov 2nd
    1 Files
  • 3
    Nov 3rd
    1 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    19 Files
  • 6
    Nov 6th
    65 Files
  • 7
    Nov 7th
    22 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    1 Files
  • 10
    Nov 10th
    1 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    65 Files
  • 13
    Nov 13th
    27 Files
  • 14
    Nov 14th
    22 Files
  • 15
    Nov 15th
    18 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close