[CVE-2007-6239] squid-2.X and squid-3.x are vulnerable

[Stephan Rügamer]

Binary package hint: squid

Dear colleagues,

squid-2.X and squid-3.x are vulnerable.

Message from NVD:

The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers.

This applies to all squid packages in our supported releases.

Severity: (from upstream: http://www.squid-cache.org/Advisories/SQUID-2007_2.txt)

This problem allows any client trusted to use the service to
 perform a denial of service attack on the Squid service.

[Chuck Short (zulcss)]

This is fixed by http://www.ubuntu.com/usn/usn-565-1.

Thanks
chuck

[Chuck Short (zulcss)]

Whoops

[Chuck Short (zulcss)]

Im in the process of backporting the fix.

Regards
chuck

[Chuck Short (zulcss)]

I have attached a debdiff for feisty.

[Chuck Short (zulcss)]

I have attached a debdiff for gutsy as well.

Regards
chuck

[Jamie Strandboge (jdstrand)]

http://www.ubuntu.com/usn/usn-565-1

[Jamie Strandboge (jdstrand)]

Hardy not affected (fixed in 3.0.RC1-3).

[Jamie Strandboge (jdstrand)]

squid3 (3.0.PRE5-5ubuntu0.1) feisty-security; urgency=low

  [ Chuck Short ]
  * SECURITY UPDATE: Clean up squid cache correctly.
  * Add CVE-2007-6239.dpatch
  * References:
    CVE-2007-6239

  [ Jamie Strandboge ]
  * Modify Maintainer value to match the DebianMaintainerField
    specification.

 -- Jamie Strandboge <email address hidden> Fri, 1 Feb 2008 17:37:35 +0000

[Jamie Strandboge (jdstrand)]

squid3 (3.0.PRE6-1ubuntu0.1) gutsy-security; urgency=low

  [ Chuck Short ]
  * SECURITY UPDATE: Clean up squid cache correctly.
  * Add CVE-2007-6239.dpatch
  * References:
    CVE-2007-6239

  [ Jamie Strandboge ]
  * Modify Maintainer value to match the DebianMaintainerField
    specification.

 -- Jamie Strandboge <email address hidden> Fri, 01 Feb 2008 17:36:16 +0000