LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: October 20th, 2014
Linux Advisory Watch: October 17th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Debian: polipo denial of service Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Debian Several denial of service vulnerabilities have been discovered in polipo, a small, caching web proxy. The Common Vulnerabilities and Exposures project identifies the following problems:
- ------------------------------------------------------------------------
Debian Security Advisory DSA-2002-1                  security@debian.org
http://www.debian.org/security/                           Stefan Fritsch
February 19, 2010                     http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : polipo
Vulnerability  : denial of service
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2009-3305 CVE-2009-4413
Debian bug     : 547047 560779

Several denial of service vulnerabilities have been discovered in polipo, a
small, caching web proxy. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2009-3305

    A malicous remote sever could cause polipo to crash by sending an
    invalid Cache-Control header.

CVE-2009-4143

    A malicous client could cause polipo to crash by sending a large
    Content-Length value.

This upgrade also fixes some other bugs that could lead to a daemon crash
or an infinite loop and may be triggerable remotely.

For the stable distribution (lenny), these problems have been fixed in
version 1.0.4-1+lenny1.

For the testing distribution (squeeze) and the unstable distribution (sid),
these problems have been fixed in version 1.0.4-3.


We recommend that you upgrade your polipo packages.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 5.0 alias lenny (stable)
- -----------------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1.dsc
    Size/MD5 checksum:     1042 4bb50ed5472fcd6b264cb89816586bbe
  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1.diff.gz
    Size/MD5 checksum:    13430 4cc90f3327e4018c56b4e140cbcb2f46
  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4.orig.tar.gz
    Size/MD5 checksum:   180487 defdce7f8002ca68705b6c2c36c4d096

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_alpha.deb
    Size/MD5 checksum:   220166 1a352d494225a07a9073681be4bac47c

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_amd64.deb
    Size/MD5 checksum:   203454 381798d0cb7c64fc221bee69eb8b6a55

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_arm.deb
    Size/MD5 checksum:   201570 935d8f17f67c30c2910e057021d2c917

armel architecture (ARM EABI)

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_armel.deb
    Size/MD5 checksum:   203706 99e563f18c123c3ca6508acdfd7f61f1

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_hppa.deb
    Size/MD5 checksum:   211750 41caee7138a21b342d9821e0d098298c

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_i386.deb
    Size/MD5 checksum:   191848 33af29a3f9e091dd6437fc3f3bfccab9

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_ia64.deb
    Size/MD5 checksum:   266176 0643774c9cdd1386f66ca090b303a369

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_mips.deb
    Size/MD5 checksum:   209536 5df3adcad12bccd7135a3fc9fb224af0

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_mipsel.deb
    Size/MD5 checksum:   209834 4961e97e904853264a1bd03fbb767abd

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_powerpc.deb
    Size/MD5 checksum:   199224 6ebb7bd7a1cb453650efee37cb742506

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_s390.deb
    Size/MD5 checksum:   209310 642204b4effb7d2e801147bdb5581ac1

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_sparc.deb
    Size/MD5 checksum:   198238 1e9c3cb3e6818f3f72f5aa4ab247da65


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Weekend Edition
The Hacktivist as Angry Young Man
The Hacker Wars Hits NYC
CAINE Linux Distribution Helps Investigators With Forensic Analysis
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.