int(5112)

Boletines de Vulnerabilidades


Múltiples vulnerabilidades en Squid

Clasificación de la vulnerabilidad

Propiedad Valor
Nivel de Confianza Oficial
Impacto Obtener acceso
Dificultad Experto
Requerimientos del atacante Acceso remoto sin cuenta a un servicio estandar

Información sobre el sistema

Propiedad Valor
Fabricante afectado GNU/Linux
Software afectado Squid 2.x
Squid 3.0 < 3.0.STABLE22
Squid 3.1 < 3.1.0.15

Descripción

Se han descubierto múltiples vulnerabilidades en Squid 2.7. Las vulnerabilidades se describen a continuación:

- CVE-2009-2855: Se ha descubierto una vulnerabilidad en la función "strListGetItem" en "src/HttpHeaderTools.c". Un atacante remoto podría causar una denegación de servicio mediante una cabecera "auth" especialmente diseñada con una coma (,) que provoca un bucle infinito de llamadas a la función "strcspn".

- CVE-2010-0308: Se ha descubierto una vulnerabilidad en "lib/rfc1035.c". Un atacante remoto podría causar una denegación de servicio mediante un paquete DNS que solo contiene una cabecera.

Solución



Actualización de software

Debian (DSA-1991-1)

Debian Linux 4.0
Source
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5.diff.gz
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2.dsc
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5.orig.tar.gz
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2.diff.gz
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5.orig.tar.gz
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5.dsc
Arquitectura independiente:
http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3.0.PRE5-5+etch2_all.deb
http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6.5-6etch5_all.deb
alpha (DEC Alpha)
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_alpha.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_alpha.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_alpha.deb
amd64 (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_amd64.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_amd64.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_amd64.deb
hppa (HP PA RISC)
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_hppa.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_hppa.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_hppa.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_hppa.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_hppa.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_hppa.deb
i386 (Intel ia32)
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_i386.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_i386.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_i386.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_i386.deb
ia64 (Intel ia64)
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_ia64.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_ia64.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_ia64.deb
mipsel (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_mipsel.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_mipsel.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_mipsel.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_mipsel.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_mipsel.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_mipsel.deb
s390 (IBM S/390)
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_s390.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_s390.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_s390.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_s390.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_s390.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_s390.deb
sparc (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_sparc.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_sparc.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_sparc.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_sparc.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_sparc.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_sparc.deb

Debian (DSA-1991-1)

Debian Linux 5.0
Source
http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1.diff.gz
http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1.dsc
http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3.orig.tar.gz
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3.dsc
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3.diff.gz
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8.orig.tar.gz
Arquitectura independiente:
http://security.debian.org/pool/updates/main/s/squid/squid-common_2.7.STABLE3-4.1lenny1_all.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3.0.STABLE8-3+lenny3_all.deb
alpha (DEC Alpha)
http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_alpha.deb
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_alpha.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_alpha.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_alpha.deb
amd64 (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_amd64.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_amd64.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_amd64.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_amd64.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_amd64.deb
arm (ARM)
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_arm.deb
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_arm.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_arm.deb
armel (ARM EABI)
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_armel.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_armel.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_armel.deb
hppa (HP PA RISC)
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_hppa.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_hppa.deb
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_hppa.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_hppa.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_hppa.deb
i386 (Intel ia32)
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_i386.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_i386.deb
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_i386.deb
ia64 (Intel ia64)
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_ia64.deb
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_ia64.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_ia64.deb
mipsel (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_mipsel.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_mipsel.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_mipsel.deb
powerpc (PowerPC)
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_powerpc.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_powerpc.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_powerpc.deb
s390 (IBM S/390)
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_s390.deb
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_s390.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_s390.deb
sparc (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_sparc.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_sparc.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_sparc.deb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_sparc.deb
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_sparc.deb

Suse Linux
Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux.

Red Hat (RHSA-2010:0221-4)
RHEL Desktop Workstation (v. 5 cliente)
Red Hat Enterprise Linux (v. 5 servidor)
https://rhn.redhat.com/

Identificadores estándar

Propiedad Valor
CVE CVE-2009-2855
CVE-2010-0308
BID 36091
37522

Recursos adicionales

Debian Security Advisory (DSA-1991-1)
http://lists.debian.org/debian-security-announce/2010/msg00031.html

SUSE Security Advisory (SUSE-SA:2010:007)
http://www.novell.com/linux/security/advisories/2010_7_sr.html

Red Hat Security Advisory (RHSA-2010:0221-4)
https://rhn.redhat.com/errata/RHSA-2010-0221.html

Histórico de versiones

Versión Comentario Fecha
1.0 Aviso emitido 2010-02-22
1.1 Aviso emitido por Suse (SUSE-SA:2010:007) 2010-04-09
1.2 Aviso emitido por Red Hat (RHSA-2010:0221-4) 2010-04-12

Miembros de

Ministerio de Defensa
CNI
CCN
CCN-CERT