From: [email protected]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------- Debian Security Advisory DSA-1843-1 [email protected] http://www.debian.org/security/ Nico Golde
July 28th, 2009 http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package : squid3
Vulnerability : several
Problem type : remote
Debian-specific: no
Debian bug : 538989
CVE ID : none assigned yet

It was discovered that squid3, a high-performance proxy caching server for
web clients, is prone to several denial of service attacks. Due to incorrect bounds checking and insufficient validation while processing response and request data an attacker is able to crash the squid daemon via crafted
requests or responses.


The squid package in the oldstable distribution (etch) is not affected
by this problem.

For the stable distribution (lenny), this problem has been fixed in
version 3.0.STABLE8-3+lenny1.

For the testing distribution (squeeze) and the unstable distribution (sid), this problem will be fixed soon.


We recommend that you upgrade your squid3 packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny1.dsc
Size/MD5 checksum: 1192 c13b5a7e1b159c587c343c93ffe3954f
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny1.diff.gz
Size/MD5 checksum: 18440 9d092a60dd0fdd48493762783ade11bb
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8.orig.tar.gz
Size/MD5 checksum: 2443502 b5d26e1b7e2285bb60cf4de249113722

Architecture independent packages:

http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3.0.STABLE8-3+lenny1_all.deb
Size/MD5 checksum: 290774 dbded6c5489997cb462a146187f8ee17

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny1_alpha.deb
Size/MD5 checksum: 94472 5bd96fdea0d63b8048cc962a35947cc7
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny1_alpha.deb
Size/MD5 checksum: 90352 fc84b58b9e69594240fe36e8999cb2c5
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny1_alpha.deb
Size/MD5 checksum: 1121878 960f3e7e69fc64012fb045188796d79b

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny1_amd64.deb
Size/MD5 checksum: 93164 05f7aef3d58fa379de7b697d6c205033
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny1_amd64.deb
Size/MD5 checksum: 1009536 6063788652160e51a4794ca3e16f92de
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny1_amd64.deb
Size/MD5 checksum: 89324 703674793864a7f922df9ce9edb98ec4

arm architecture (ARM)

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny1_arm.deb
Size/MD5 checksum: 979862 08d161d799ae9a5339d52286151e3178
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny1_arm.deb
Size/MD5 checksum: 87014 b9b50f3725f906075bdc5dc011381bf9
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny1_arm.deb
Size/MD5 checksum: 90196 84e98cfac9522c7cccf4d8670f5252be

armel architecture (ARM EABI)

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny1_armel.deb
Size/MD5 checksum: 930658 476e440432b2c80a9d08cd4399ad8172
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny1_armel.deb
Size/MD5 checksum: 91112 51cfde8ffd3b6bb72580e4325c2d4b6e
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny1_armel.deb
Size/MD5 checksum: 88124 6ff1a03aeb679b5730f59f0e965bbe74

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny1_hppa.deb
Size/MD5 checksum: 1164302 78c67658ce02fcfd787ab0e76d4a95f7
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny1_hppa.deb
Size/MD5 checksum: 89500 43118718af5808bd3bb7acb83f5ddc08
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny1_hppa.deb
Size/MD5 checksum: 93330 4a85a0dd699c2e1631167998d2c7806b

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny1_i386.deb
Size/MD5 checksum: 87030 a4a37bb05605ec21fc34f9021825bd16
http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny1_i386.deb
Size/MD5 checksum: 90954 d8b8003626029cb1566cb9bd6906791e
http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny1_i386.deb
Size/MD5 checksum: 934256 0b647a464eb9512dd4a263ad72c4c390

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny1_ia64.deb
Size/MD5 checksum: 99446 acd6b508daa799c6bb80017fa82da224
http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny1_ia64.deb
Size/MD5 checksum: 93348 73bf9f2b4e793edd20253ac214cdd75a

[continued in next message]

--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)