-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                         ESB-2008.0120 -- [Debian]
                 New squid packages fix denial of service
                              6 February 2008

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              squid
Publisher:            Debian
Operating System:     Debian GNU/Linux 4.0
Impact:               Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-6239

Ref:                  ESB-2007.1023

Original Bulletin:    http://www.debian.org/security/2008/dsa-1482

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ------------------------------------------------------------------------
Debian Security Advisory DSA-1482-1                  security@debian.org
http://www.debian.org/security/                       Moritz Muehlenhoff
February 05, 2008                     http://www.debian.org/security/faq
- - ------------------------------------------------------------------------

Package        : squid
Vulnerability  : programming error
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2007-6239

It was discovered that malformed cache update replies against the Squid
WWW proxy cache could lead to the exhaustion of system memory, resulting
in potential denial of service.

For the stable distribution (etch), this problem has been fixed in
version 2.6.5-6etch1.

For the old stable distribution (sarge), the update cannot currently
be processed on the buildd security network due to a bug in the archive
management script. This will be resolved soon. An update for i386
is temporarily available at at http://people.debian.org/~jmm/squid/.

We recommend that you upgrade your squid packages.

Upgrade instructions
- - --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian 4.0 (stable)
- - -------------------

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1.dsc
    Size/MD5 checksum:      669 47baab1a60087828b695388c6edb1ee6
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5.orig.tar.gz
    Size/MD5 checksum:  1636886 26cc918028340dc8ceb9c0c4b988d717
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1.diff.gz
    Size/MD5 checksum:   273904 db13c592e621e1b8571c01846842b8fd

Architecture independent packages:

  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6.5-6etch1_all.deb
    Size/MD5 checksum:   437110 ac8cac2b29366e044e8362a7b394fc9d

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1_alpha.deb
    Size/MD5 checksum:   791040 6e313f97d91d37b726eea9194ded5a5b
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch1_alpha.deb
    Size/MD5 checksum:    87964 e6cb717df88977abfe41597384d96f6d
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch1_alpha.deb
    Size/MD5 checksum:   119136 79b01bf8b6310cca9812cfae2c7b3170

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1_amd64.deb
    Size/MD5 checksum:   710400 9141b003810e1c50c364cd0303efd74f
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch1_amd64.deb
    Size/MD5 checksum:   116352 1bf89f1f564164df73e3c32515e63ffb
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch1_amd64.deb
    Size/MD5 checksum:    86070 2818713df831edc4aeb01b3686d31e79

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch1_arm.deb
    Size/MD5 checksum:   115880 4c8cef9241a1377f7f49cab25af3b9b8
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1_arm.deb
    Size/MD5 checksum:   676344 f693173e2c78bcda2211a1323ac85f9b
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch1_arm.deb
    Size/MD5 checksum:    85944 a9a014a349f7f826bf271fcdb1337334

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch1_hppa.deb
    Size/MD5 checksum:   117330 28e6069fb0b0e71b6f7d2a550cea9570
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1_hppa.deb
    Size/MD5 checksum:   749000 abe4f58c0af4c5837a8ed1bf3b109b8b
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch1_hppa.deb
    Size/MD5 checksum:    87644 5c50485a6cf9faaa75ab97171464d4f1

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1_i386.deb
    Size/MD5 checksum:   654734 bdc20bc1b981d81b23e11eaa51b5d446
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch1_i386.deb
    Size/MD5 checksum:    85694 a125ae94c477acbd039916cb5295495c
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch1_i386.deb
    Size/MD5 checksum:   116008 ad3a1b4e437ea7a54aa27322d4ab5aa3

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1_ia64.deb
    Size/MD5 checksum:  1066988 33f9cb183e83c91999b0fca9d7535a04
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch1_ia64.deb
    Size/MD5 checksum:    91272 dd10ed4eea19bde3c1e201c47aff656d
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch1_ia64.deb
    Size/MD5 checksum:   124104 f6f9be771782b221d1faea48d8ee842f

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch1_mips.deb
    Size/MD5 checksum:   117058 6bd05ff7a166f10235a490d83adc9aaa
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch1_mips.deb
    Size/MD5 checksum:    87190 71adec3b47f6d047c5f00cb65986abc4
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1_mips.deb
    Size/MD5 checksum:   742994 81160ebb191aa27d0c77e4454d2e13e3

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch1_mipsel.deb
    Size/MD5 checksum:   117110 001be9f34ed3140d2fa8e4c698d08b4a
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch1_mipsel.deb
    Size/MD5 checksum:    87182 63006b975b09a4069bedaa5d78ab68d7
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1_mipsel.deb
    Size/MD5 checksum:   747278 16486cdd91d2c1ddc68e2b3329cc0d94

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1_powerpc.deb
    Size/MD5 checksum:   712288 694870f8b4dd3fed1e1133f82f584557
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch1_powerpc.deb
    Size/MD5 checksum:    86036 91ed9e4120cc6667ae5956ff8d2df43a
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch1_powerpc.deb
    Size/MD5 checksum:   116278 925d2622313fbc249ba896dc3ce87483

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch1_s390.deb
    Size/MD5 checksum:   116628 162bcb6411f90ce10b0406cca1cc081b
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch1_s390.deb
    Size/MD5 checksum:    86486 0373bb3d5504cd041025a41fcae00fb4
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1_s390.deb
    Size/MD5 checksum:   711796 c7458baad180e177878eb324a5208488

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch1_sparc.deb
    Size/MD5 checksum:   667184 247fddedfe397f756ebb00d6b44c413a
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch1_sparc.deb
    Size/MD5 checksum:    86224 3c22a2f372efb50fc7c1976a20c9fdc2
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch1_sparc.deb
    Size/MD5 checksum:   115852 90d0326044c9796c51b73dd09aa7c34a


  These files will probably be moved into the stable distribution on
  its next update.

- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHqOWbXm3vHE4uyloRAiMrAJ9cS5saJzLK0WAut9cnELFH+XYtigCgzuQy
WB2tkIUdYw0jKUMjrQqoARI=
=hBUA
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBR6judSh9+71yA2DNAQJwVQP/ZEfmHmZcwsyxFKPyahL3atx/9rdCiAJV
vYeVhjfepxJtcUHrVaecH9rwDjt1mfPo49kFBn6CvIFSrUhkrCeFLCdPTli73p2x
fMyQrocwsmb85BUQnXx0Fnp9YE5zkCyJO6U3EepMuywSk7HCVHZSsdIxuFGtq5hR
PAAHFNmSi6k=
=UtYN
-----END PGP SIGNATURE-----