6857164 2001-08-06 09:57 -0600 /121 rader/ Support Info <supinfo@caldera.com>
Sänt av: joel@lysator.liu.se
Importerad: 2001-08-06 21:52 av Brevbäraren
Extern mottagare: announce@lists.caldera.com
Extern mottagare: bugtraq@securityfocus.com
Extern mottagare: linux-security@redhat.com
Extern mottagare: linuxlist@securityportal.com
Mottagare: Bugtraq (import) <18648>
Ärende: Security Update [CSSA-2001-029.0] Linux - Squid configuration problems
------------------------------------------------------------
From: Support Info <supinfo@caldera.com>
To: announce@lists.caldera.com, bugtraq@securityfocus.com,
linux-security@redhat.com, linuxlist@securityportal.com
Message-ID: <20010806095707.C8518@phoenix.calderasystems.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
Caldera International, Inc. Security Advisory
Subject: Linux - Squid configuration problems
Advisory number: CSSA-2001-029.0
Issue date: 2001, August 06
Cross reference:
______________________________________________________________________________
1. Problem Description
There is a security problem with Squid, a proxy server shipped as
part of OpenLinux 3.1 Server. If Squid is configured for
accelerator mode (setting http_accel_with_proxy off), any request
to Squid is allowed. Malicious users may use your proxy to
portscan remote systems, forge email, and other activities.
2. Vulnerable Versions
System Package
-----------------------------------------------------------
OpenLinux 2.3 not vulnerable
OpenLinux eServer 2.3.1 not vulnerable
and OpenLinux eBuilder
OpenLinux eDesktop 2.4 not vulnerable
OpenLinux Server 3.1 All packages previous to
squid-2.4.STABLE1-7
OpenLinux Workstation 3.1 not vulnerable
3. Solution
Workaround
none
The proper solution is to upgrade to the latest packages.
4. OpenLinux 2.3
not vulnerable
5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0
not vulnerable
6. OpenLinux eDesktop 2.4
not vulnerable
7. OpenLinux 3.1 Server
7.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS
The corresponding source code package can be found at:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS
7.2 Verification
1779083edd38872f2ac15c219131d1ba RPMS/squid-2.4.STABLE1-7.i386.rpm
e5020ebf7aef60878139cdac81737212 SRPMS/squid-2.4.STABLE1-7.src.rpm
7.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fvh squid-2.4.STABLE1-7.i386.rpm
8. OpenLinux 3.1 Workstation
not vulnerable
9. References
This and other Caldera security resources are located at:
http://www.caldera.com/support/security/index.html
This security fix closes Caldera's internal Problem Report 10294.
10. Disclaimer
Caldera International, Inc. is not responsible for the misuse of
any of the information we provide on this website and/or through
our security advisories. Our advisories are a service to our
customers
intended to promote secure installation and use of Caldera
OpenLinux.
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE7bo4N18sy83A/qfwRAgeNAJ9En4ytBnxpwtNz+VDAJthRA+MC2wCfS0fi
k5aqw6UmMAloEu5Pp62xQBQ=
=84hX
-----END PGP SIGNATURE-----
(6857164) /Support Info <supinfo@caldera.com>/(Ombruten)