DSA-019-1 squid -- insecure tempfile handling

Debian Security Advisory

DSA-019-1 squid -- insecure tempfile handling

Date Reported:

25 Jan 2001

Affected Packages:

squid

Vulnerable:

Yes

Security database references:

In the Bugtraq database (at SecurityFocus): BugTraq ID 2184.
In Mitre's CVE dictionary: CVE-2001-0142.

More information:

WireX discovered a potential temporary file race condition in the way that squid sends out email messages notifying the administrator about updating the program. This could lead to arbitrary files to get overwritten. However the code would only be executed if running a very bleeding edge release of squid, running a server whose time is set some number of months in the past and squid is crashing. Read it as hardly to exploit. This version also contains more upstream bugfixes wrt. dots in hostnames and improper HTML quoting.

Fixed in:

Debian 2.2 (potato)

Source:

http://security.debian.org/dists/stable/updates/main/source/squid_2.2.5-3.1.diff.gz

http://security.debian.org/dists/stable/updates/main/source/squid_2.2.5-3.1.dsc

http://security.debian.org/dists/stable/updates/main/source/squid_2.2.5.orig.tar.gz

alpha:

http://security.debian.org/dists/stable/updates/main/binary-alpha/squid-cgi_2.2.5-3.1_alpha.deb

http://security.debian.org/dists/stable/updates/main/binary-alpha/squid_2.2.5-3.1_alpha.deb

http://security.debian.org/dists/stable/updates/main/binary-alpha/squidclient_2.2.5-3.1_alpha.deb

arm:

http://security.debian.org/dists/stable/updates/main/binary-arm/squid-cgi_2.2.5-3.1_arm.deb

http://security.debian.org/dists/stable/updates/main/binary-arm/squid_2.2.5-3.1_arm.deb

http://security.debian.org/dists/stable/updates/main/binary-arm/squidclient_2.2.5-3.1_arm.deb

i386:

http://security.debian.org/dists/stable/updates/main/binary-i386/squid-cgi_2.2.5-3.1_i386.deb

http://security.debian.org/dists/stable/updates/main/binary-i386/squid_2.2.5-3.1_i386.deb

http://security.debian.org/dists/stable/updates/main/binary-i386/squidclient_2.2.5-3.1_i386.deb

m68k:

http://security.debian.org/dists/stable/updates/main/binary-m68k/squid-cgi_2.2.5-3.1_m68k.deb

http://security.debian.org/dists/stable/updates/main/binary-m68k/squid_2.2.5-3.1_m68k.deb

http://security.debian.org/dists/stable/updates/main/binary-m68k/squidclient_2.2.5-3.1_m68k.deb

powerpc:

http://security.debian.org/dists/stable/updates/main/binary-powerpc/squid-cgi_2.2.5-3.1_powerpc.deb

http://security.debian.org/dists/stable/updates/main/binary-powerpc/squid_2.2.5-3.1_powerpc.deb

http://security.debian.org/dists/stable/updates/main/binary-powerpc/squidclient_2.2.5-3.1_powerpc.deb

sparc:

http://security.debian.org/dists/stable/updates/main/binary-sparc/squid-cgi_2.2.5-3.1_sparc.deb

http://security.debian.org/dists/stable/updates/main/binary-sparc/squid_2.2.5-3.1_sparc.deb

http://security.debian.org/dists/stable/updates/main/binary-sparc/squidclient_2.2.5-3.1_sparc.deb