News

=========================================================== Ubuntu Security Notice USN-67-1 January 20, 2005 squid vulnerabilities CAN-2005-0094, CAN-2005-0095, CAN-2005-0096, CAN-2005-0097 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) The following packages are affected: squid The problem can be corrected by upgrading the affected package to version 2.5.5-6ubuntu0.3. In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: infamous41md discovered several Denial of Service vulnerabilities in squid. A malicious Gopher server could crash squid by sending a line bigger than 4096 bytes. (CAN-2005-0094) If squid is configured to send WCPP (Web Cache Communication Protocol) messages to a "home router", an attacker who was able to send UDP packets with a forged source address of this router could crash the erver with a specially crafted WCPP message. (CAN-2005-0095) Previous versions of squid have a memory leak which gradually cause memory exhaustion and eventual termination. (CAN-2005-0096) A remote attacker could crash the server by sending a specially crafted NTLM type 3 packet. (CAN-2005-0097)