|
Family: Ubuntu Local Security Checks --> Category: infos
USN67-1 : squid vulnerabilities Vulnerability Scan
Vulnerability Scan Summary squid vulnerabilities
Detailed Explanation for this Vulnerability Test
Synopsis :
These remote packages are missing security patches :
- squid
- squid-cgi
- squid-common
- squidclient
Description :
infamous41md discovered several Denial of Service vulnerabilities in
squid.
A malicious Gopher server could crash squid by sending a line bigger
than 4096 bytes. (CVE-2005-0094)
If squid is configured to send WCPP (Web Cache Communication Protocol)
messages to a "home router", a possible hacker who was able to send UDP
packets with a forged source address of this router could crash the
erver with a specially crafted WCPP message. (CVE-2005-0095)
Previous versions of squid have a memory leak which gradually cause
memory exhaustion and eventual termination. (CVE-2005-0096)
A remote attacker could crash the server by sending a specially
crafted NTLM type 3 packet. (CVE-2005-0097)
Solution :
Upgrade to :
- squid-2.5.5-6ubuntu0.3 (Ubuntu 4.10)
- squid-cgi-2.5.5-6ubuntu0.3 (Ubuntu 4.10)
- squid-common-2.5.5-6ubuntu0.3 (Ubuntu 4.10)
- squidclient-2.5.5-6ubuntu0.3 (Ubuntu 4.10)
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|