Skip to navigation

Security Advisory squid security update

Advisory: RHSA-2005:173-09
Type: Security Advisory
Severity: Moderate
Issued on: 2005-03-03
Last updated on: 2005-03-03
Affected Products: Red Hat Desktop (v. 3)
Red Hat Enterprise Linux AS (v. 2.1)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux ES (v. 2.1)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux WS (v. 3)
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor
CVEs (cve.mitre.org): CVE-2005-0446

Details

Updated squid packages that fix a denial of service issue are now available.

This update has been rated as having important security impact by the Red
Hat Security Response Team

Squid is a full-featured Web proxy cache.

A bug was found in the way Squid handles FQDN lookups. It was possible
to crash the Squid server by sending a carefully crafted DNS response to
an FQDN lookup. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-0446 to this issue.

Users of squid should upgrade to this updated package, which contains a
backported patch, and is not vulnerable to this issue.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Updated packages

Red Hat Desktop (v. 3)

IA-32:
squid-2.5.STABLE3-6.3E.8.i386.rpm
File outdated by:  RHSA-2008:0214
    MD5: 25f9ca52f04b6571c9b29b2de47a82e4
 
x86_64:
squid-2.5.STABLE3-6.3E.8.x86_64.rpm
File outdated by:  RHSA-2008:0214
    MD5: c2757abe79275c3b8ff61abb3a9c2406
 
Red Hat Enterprise Linux AS (v. 2.1)

IA-32:
squid-2.4.STABLE7-1.21as.5.i386.rpm
File outdated by:  RHSA-2008:0214
    MD5: 81505707ca33f4870a62382b88745bbc
 
IA-64:
squid-2.4.STABLE7-1.21as.5.ia64.rpm
File outdated by:  RHSA-2008:0214
    MD5: c3a025c8b1847017da5e05d039e3bcc0
 
Red Hat Enterprise Linux AS (v. 3)

IA-32:
squid-2.5.STABLE3-6.3E.8.i386.rpm
File outdated by:  RHSA-2008:0214
    MD5: 25f9ca52f04b6571c9b29b2de47a82e4
 
IA-64:
squid-2.5.STABLE3-6.3E.8.ia64.rpm
File outdated by:  RHSA-2008:0214
    MD5: 429a13ef1b3e9dce3fe157cd3b6d1651
 
PPC:
squid-2.5.STABLE3-6.3E.8.ppc.rpm
File outdated by:  RHSA-2008:0214
    MD5: e3f3bab5baefba94302135e61499683f
 
s390:
squid-2.5.STABLE3-6.3E.8.s390.rpm
File outdated by:  RHSA-2008:0214
    MD5: 0c97fc7f12ac29445de550ec866feb82
 
s390x:
squid-2.5.STABLE3-6.3E.8.s390x.rpm
File outdated by:  RHSA-2008:0214
    MD5: 9a2a1b5c70a510695ee560fe55358228
 
x86_64:
squid-2.5.STABLE3-6.3E.8.x86_64.rpm
File outdated by:  RHSA-2008:0214
    MD5: c2757abe79275c3b8ff61abb3a9c2406
 
Red Hat Enterprise Linux ES (v. 2.1)

IA-32:
squid-2.4.STABLE7-1.21as.5.i386.rpm
File outdated by:  RHSA-2008:0214
    MD5: 81505707ca33f4870a62382b88745bbc
 
Red Hat Enterprise Linux ES (v. 3)

IA-32:
squid-2.5.STABLE3-6.3E.8.i386.rpm
File outdated by:  RHSA-2008:0214
    MD5: 25f9ca52f04b6571c9b29b2de47a82e4
 
IA-64:
squid-2.5.STABLE3-6.3E.8.ia64.rpm
File outdated by:  RHSA-2008:0214
    MD5: 429a13ef1b3e9dce3fe157cd3b6d1651
 
x86_64:
squid-2.5.STABLE3-6.3E.8.x86_64.rpm
File outdated by:  RHSA-2008:0214
    MD5: c2757abe79275c3b8ff61abb3a9c2406
 
Red Hat Enterprise Linux WS (v. 3)

IA-32:
squid-2.5.STABLE3-6.3E.8.i386.rpm
File outdated by:  RHSA-2008:0214
    MD5: 25f9ca52f04b6571c9b29b2de47a82e4
 
IA-64:
squid-2.5.STABLE3-6.3E.8.ia64.rpm
File outdated by:  RHSA-2008:0214
    MD5: 429a13ef1b3e9dce3fe157cd3b6d1651
 
x86_64:
squid-2.5.STABLE3-6.3E.8.x86_64.rpm
File outdated by:  RHSA-2008:0214
    MD5: c2757abe79275c3b8ff61abb3a9c2406
 
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor

IA-64:
squid-2.4.STABLE7-1.21as.5.ia64.rpm
File outdated by:  RHSA-2008:0214
    MD5: c3a025c8b1847017da5e05d039e3bcc0
 

Bugs fixed (see bugzilla for more information)

148882 - CAN-2005-0446 Squid DoS from bad DNS response


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/