RedHat: Low: squid security update RHSA-2005:489-01

An updated squid package that fixes several security issues is now available. This update has been rated as having low security impact by the Red Hat Security Response Team.

Summary

Squid is a full-featured Web proxy cache. A bug was found in the way Squid handles PUT and POST requests. It is possible for an authorised remote user to cause a failed PUT or POST request which can cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0718 to this issue. A bug was found in the way Squid handles access to the cachemgr.cgi script. It is possible for an authorised remote user to bypass access control lists with this flaw. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-0710 to this issue. A bug was found in the way Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall, it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1519 to this issue. Additionally, this update fixes the following bugs: - squid fails in the unpacking of squid-2.4.STABLE7-1.21as.5.src.rpm Users of Squid should upgrade to this updated package, which contains backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
125007 - insecure permissions for squid.conf 151423 - CAN-2005-0718 Segmentation fault on failed PUT/POST request 153960 - It fails in the unpacking of squid-2.4.STABLE7-1.21as.5.src.rpm 156161 - CVE-1999-0710 cachemgr.cgi access control bypass 157455 - CAN-2005-1519 DNS lookups unreliable on untrusted networks

6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS: 94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm
i386: 08c0d416b59e426120c9f7932e974f9d squid-2.4.STABLE7-1.21as.8.i386.rpm
ia64: 9e15091928dd05b3f8dcf9f2285bd608 squid-2.4.STABLE7-1.21as.8.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS: 94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm
ia64: 9e15091928dd05b3f8dcf9f2285bd608 squid-2.4.STABLE7-1.21as.8.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS: 94a0e2ba3779a229af1d161555341cc2 squid-2.4.STABLE7-1.21as.8.src.rpm
i386: 08c0d416b59e426120c9f7932e974f9d squid-2.4.STABLE7-1.21as.8.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0710 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0718 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1519

Package List

Severity

Advisory ID: RHSA-2005:489-01

Advisory URL: https://access.redhat.com/errata/RHSA-2005:489.html

Issued Date: : 2005-06-13

Updated on: 2005-06-13

Product: Red Hat Enterprise Linux

CVE Names: CVE-1999-0710 CAN-2005-0718 CAN-2005-1519 An updated squid package that fixes several security issues is now available. This update has been rated as having low security impact by the Red Hat Security Response Team.