To: bugtraqat_private announceat_private security-alertsat_private full-disclosureat_private ______________________________________________________________________________ SCO Security Advisory Subject: Linux: buffer overflows and other security issues in squid Advisory number: CSSA-2002-046.0 Issue date: 2002 November 14 Cross reference: ______________________________________________________________________________ 1. Problem Description From the Squid Team's SQUID-2002:3 advisory: - Several bugfixes and cleanup of the Gopher client, both to correct some security issues and to make Squid properly render certain Gopher menus. - Security fixes in how Squid parses FTP directory listings into HTML. - FTP data channels are now sanity checked to match the address of the requested FTP server. This to prevent theft or injection of data. See the new ftp_sanitycheck directive if this sanity check is not desired. - The MSNT auth helper has been updated to v2.0.3+fixes for buffer overflow security issues found in this helper. - A security issue in how Squid forwards proxy authentication credentials has been fixed. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to squid-2.5-20020429.i386.rpm OpenLinux 3.1 Server prior to squid-2.5-20020429.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-046.0/RPMS 4.2 Packages fdda342fe954cf6ea304046781a555c8 squid-2.5-20020429.i386.rpm 4.3 Installation rpm -Fvh squid-2.5-20020429.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-046.0/SRPMS 4.5 Source Packages 379f8d5732aaa5ec8bcb4f80e061c501 squid-2.5-20020429.src.rpm 5. OpenLinux 3.1 Server 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-046.0/RPMS 5.2 Packages 23eb5b61f6c05ec3c0d0c79ee3cc7fa4 squid-2.5-20020429.i386.rpm 5.3 Installation rpm -Fvh squid-2.5-20020429.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-046.0/SRPMS 5.5 Source Packages 3d322a9bbff5bcb0b320d1cdc0f67037 squid-2.5-20020429.src.rpm 6. References Specific references for this advisory: http://www.squid-cache.org/Advisories/SQUID-2002_3.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0713 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr866628, fz521510, erg501626. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements SCO wishes to thank The Squid HTTP Proxy team for the fixes. ______________________________________________________________________________
This archive was generated by hypermail 2b30 : Thu Nov 14 2002 - 16:53:21 PST