Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Sign up!
EnGarde Community
What is the most important Linux security technology?
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Latest Newsletters
Linux Advisory Watch: March 27th, 2015
Linux Security Week: March 23rd, 2015
LinuxSecurity Newsletters
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

Mandrake: Updated squid packages fix Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake More vulnerabilities were discovered in the squid server: The LDAP handling of search filters was inadequate which could be abused to allow logins using severial variants of a single login name, possibly bypassing explicit access controls (CAN-2005-0173).

                 Mandrakelinux Security Update Advisory

 Package name:           squid
 Advisory ID:            MDKSA-2005:034
 Date:                   February 10th, 2005

 Affected versions:	 10.0, 10.1, 9.2, Corporate 3.0,
			 Corporate Server 2.1

 Problem Description:

 More vulnerabilities were discovered in the squid server:
 The LDAP handling of search filters was inadequate which could be
 abused to allow logins using severial variants of a single login name,
 possibly bypassing explicit access controls (CAN-2005-0173).
 Minor problems in the HTTP header parsing code that could be used for
 cache poisoning (CAN-2005-0174 and CAN-2005-0175).
 A buffer overflow in the WCCP handling code allowed remote attackers
 to cause a Denial of Service and could potentially allow for the
 execution of arbitrary code by using a long WCCP packet.
 The updated packages have been patched to prevent these problems.


 Updated Packages:
 Mandrakelinux 10.0:
 656b659ee9ba2c1a08e24d1187a2c29f  10.0/RPMS/squid-2.5.STABLE4-2.4.100mdk.i586.rpm
 d856951204f2d02932e7bb413bb31bfa  10.0/SRPMS/squid-2.5.STABLE4-2.4.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 432ea3eabd02f1f3b18919b23a3f19fe  amd64/10.0/RPMS/squid-2.5.STABLE4-2.4.100mdk.amd64.rpm
 d856951204f2d02932e7bb413bb31bfa  amd64/10.0/SRPMS/squid-2.5.STABLE4-2.4.100mdk.src.rpm

 Mandrakelinux 10.1:
 a5bf0588457cd842d2326f647ebcbc25  10.1/RPMS/squid-2.5.STABLE6-2.3.101mdk.i586.rpm
 b726f35ab93d4a12576a7923e374e5bf  10.1/SRPMS/squid-2.5.STABLE6-2.3.101mdk.src.rpm

 Mandrakelinux 10.1/X86_64:
 96e84ddeb61f432b7358344da7608f25  x86_64/10.1/RPMS/squid-2.5.STABLE6-2.3.101mdk.x86_64.rpm
 b726f35ab93d4a12576a7923e374e5bf  x86_64/10.1/SRPMS/squid-2.5.STABLE6-2.3.101mdk.src.rpm

 Corporate Server 2.1:
 50c44984c30f4c8e0db630da66411c70  corporate/2.1/RPMS/squid-2.4.STABLE7-2.4.C21mdk.i586.rpm
 d706be0b04a5ac2e5b28b5b151181bda  corporate/2.1/SRPMS/squid-2.4.STABLE7-2.4.C21mdk.src.rpm

 Corporate Server 2.1/X86_64:
 4cd111cf43876cc401eccfc49b48148c  x86_64/corporate/2.1/RPMS/squid-2.4.STABLE7-2.4.C21mdk.x86_64.rpm
 d706be0b04a5ac2e5b28b5b151181bda  x86_64/corporate/2.1/SRPMS/squid-2.4.STABLE7-2.4.C21mdk.src.rpm

 Corporate 3.0:
 be661ea6526f37cf0efdb097319a2a46  corporate/3.0/RPMS/squid-2.5.STABLE4-2.4.C30mdk.i586.rpm
 8fd70e360e772d30e8668000a6954a1d  corporate/3.0/SRPMS/squid-2.5.STABLE4-2.4.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 13a4a4ac0b02deb4366482e3f2317b22  x86_64/corporate/3.0/RPMS/squid-2.5.STABLE4-2.4.C30mdk.x86_64.rpm
 8fd70e360e772d30e8668000a6954a1d  x86_64/corporate/3.0/SRPMS/squid-2.5.STABLE4-2.4.C30mdk.src.rpm

 Mandrakelinux 9.2:
 c421d3df715cefb0a97995269f16e931  9.2/RPMS/squid-2.5.STABLE3-3.6.92mdk.i586.rpm
 1fd8fdf79dbd6f647d00bea37be5400b  9.2/SRPMS/squid-2.5.STABLE3-3.6.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 21d4c2e94050161a6192e63304852ec7  amd64/9.2/RPMS/squid-2.5.STABLE3-3.6.92mdk.amd64.rpm
 1fd8fdf79dbd6f647d00bea37be5400b  amd64/9.2/SRPMS/squid-2.5.STABLE3-3.6.92mdk.src.rpm

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver 0x22458A98

 You can view other update advisories for Mandrakelinux at:

 If you want to report vulnerabilities, please contact

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
< Prev   Next >


Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2015 Guardian Digital, Inc. All rights reserved.