GLSA 200701-22: Squid: Multiple Denial of Service vulnerabilities
Severity: | normal |
Title: | Squid: Multiple Denial of Service vulnerabilities |
Date: | 01/25/2007 |
Bugs: |
|
ID: | 200701-22 |
Synopsis
Two vulnerabilities have been found in Squid which make it susceptible to Denial of Service attacks.Background
Squid is a multi-protocol proxy server.
Affected packages
Package | Vulnerable | Unaffected | Architecture(s) |
---|---|---|---|
net-proxy/squid | < 2.6.7 | >= 2.6.7 | All supported architectures |
Description
Squid fails to correctly handle ftp:// URI's. There is also an error in the external_acl queue which can cause an infinite looping condition.
Impact
An attacker could attempt to retrieve a specially crafted URI via a Squid server causing the service to crash. If an attacker could generate a sufficiently high load on the Squid services, they could cause a Denial of Service by forcing Squid into an infinite loop.
Workaround
There is no known workaround at this time.
Resolution
All Squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-2.6.7"
References
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.