squid-2.6.STABLE21-6.AXS3
エラータID: AXSA:2010-169:01
リリース日:
2010/04/01 Thursday - 12:09
題名:
squid-2.6.STABLE21-6.AXS3
影響のあるチャネル:
Asianux Server 3 for x86
Asianux Server 3 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Squid の strListGetItem 関数には、認証ヘッダの処理に不備があるため、サービス運用妨害 (DoS) 状態となる脆弱性が存在します。(CVE-2009-2855)
- Squid の lib/rfc1035.c には、サービス運用妨害 (DoS) 状態となる脆弱性が存在します。(CVE-2010-0308)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2009-2855
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
CVE-2010-0308
lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header.
lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header.
追加情報:
N/A
ダウンロード:
SRPMS
- squid-2.6.STABLE21-6.AXS3.src.rpm
MD5: dee77d2bdbb24253a303925947949a63
SHA-256: c72e4c60921e4a53e20659b71cbd45faa5bed6f05a6f00db3ea75135d23cee3a
Size: 1.43 MB
Asianux Server 3 for x86
- squid-2.6.STABLE21-6.AXS3.i386.rpm
MD5: 48d420dc6082fb4ced519d9f632669ab
SHA-256: e3f112264fec42c4bd44224eedb00814a0fdcd0c3b75ab1790c5f55924992909
Size: 1.31 MB
Asianux Server 3 for x86_64
- squid-2.6.STABLE21-6.AXS3.x86_64.rpm
MD5: 33b3798f404409a819e886e9b242f9a4
SHA-256: ff6f90530b806b8d0942481342ea4cf796d0a2e8c090a069af957621ddd6b52d
Size: 1.36 MB