blob: 8e90dfae3eeaa1a1676dcb3040169fa50c714bb7 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200903-38">
<title>Squid: Multiple Denial of Service vulnerabilities</title>
Multiple vulnerabilities have been found in Squid which allow for remote
Denial of Service attacks.
<product type="ebuild">Squid</product>
<announced>March 24, 2009</announced>
<revised>March 24, 2009: 01</revised>
<package name="net-proxy/squid" auto="yes" arch="*">
<unaffected range="ge">2.7.6</unaffected>
<vulnerable range="lt">2.7.6</vulnerable>
Squid is a full-featured web proxy cache.
<li>The arrayShrink function in lib/Array.c can cause an array to
shrink to 0 entries, which triggers an assert error. NOTE: this issue
is due to an incorrect fix for CVE-2007-6239 (CVE-2008-1612).</li>
<li>An invalid version number in a HTTP request may trigger an
assertion in HttpMsg.c and HttpStatusLine.c (CVE-2009-0478).</li>
<impact type="normal">
The issues allows for Denial of Service attacks against the service via
an HTTP request with an invalid version number and other specially
crafted requests.
There is no known workaround at this time.
All Squid users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=net-proxy/squid-2.7.6&quot;</code>
<uri link="">CVE-2007-6239</uri>
<uri link="">CVE-2008-1612</uri>
<uri link="">CVE-2009-0478</uri>
<uri link="/security/en/glsa/glsa-200801-05.xml">GLSA-200801-05</uri>
<metadata tag="requester" timestamp="Mon, 09 Mar 2009 14:14:34 +0000">
<metadata tag="submitter" timestamp="Mon, 16 Mar 2009 14:25:11 +0000">
<metadata tag="bugReady" timestamp="Tue, 24 Mar 2009 16:45:49 +0000">