DSA-2111-1 squid3 -- denial of service

Debian Security Advisory

DSA-2111-1 squid3 -- denial of service

Date Reported:

19 Sep 2010

Affected Packages:

squid3

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 596086.
In Mitre's CVE dictionary: CVE-2010-3072.

More information:

Phil Oester discovered that Squid-3, a fully featured Web Proxy cache, is prone to a denial of service attack via a specially crafted request that includes empty strings.

For the stable distribution (lenny), this problem has been fixed in version 3.0.STABLE8-3+lenny4.

For the testing distribution (squeeze), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in version 3.1.6-1.1.

We recommend that you upgrade your squid3 packages.

Fixed in:

Debian GNU/Linux 5.0 (lenny)

Source:

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny4.diff.gz

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny4.dsc

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8.orig.tar.gz

Architecture-independent component:

http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3.0.STABLE8-3+lenny4_all.deb

Alpha:

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny4_alpha.deb

http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny4_alpha.deb

http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny4_alpha.deb

AMD64:

http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny4_amd64.deb

http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny4_amd64.deb

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny4_amd64.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny4_i386.deb

http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny4_i386.deb

http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny4_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny4_ia64.deb

http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny4_ia64.deb

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny4_ia64.deb

Little-endian MIPS:

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny4_mipsel.deb

http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny4_mipsel.deb

http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny4_mipsel.deb

PowerPC:

http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny4_powerpc.deb

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny4_powerpc.deb

http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny4_powerpc.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny4_sparc.deb

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny4_sparc.deb

http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny4_sparc.deb

MD5 checksums of the listed files are available in the original advisory.