Debians sikkerhedsbulletin

DSA-019-1 squid -- usikker håndtering af midlertidige filer

Rapporteret den:

25. jan 2001

Berørte pakker:

squid

Sårbar:

Referencer i sikkerhedsdatabaser:

I Bugtraq-databasen (hos SecurityFocus): BugTraq-id 2184.
I Mitres CVE-ordbog: CVE-2001-0142.

Yderligere oplysninger:

WireX opdagede en potentiel "kapløbsfejl" i forbindelse med midlertidige filer, på grund af den måde squid sender e-mail-besked til administratoren om at programmet bør opdateres. Dette kunne medføre at vilkårlige filer blev overskrevet. Men koden ville kun blive udført hvis man kørte den allernyeste udgave af squid, på en server hvis ur var sat nogle måneder tilbage i tiden og squid gik ned. Med andre ord svært at udnytte. Denne version indeholder også flere opstrøms-fejlrettelser angående punktummer i hostnavne og forkert HTML-citering.

Rettet i:

Debian 2.2 (potato)

Kildekode:: http://security.debian.org/dists/stable/updates/main/source/squid_2.2.5-3.1.diff.gz; http://security.debian.org/dists/stable/updates/main/source/squid_2.2.5-3.1.dsc; http://security.debian.org/dists/stable/updates/main/source/squid_2.2.5.orig.tar.gz
alpha:: http://security.debian.org/dists/stable/updates/main/binary-alpha/squid-cgi_2.2.5-3.1_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/squid_2.2.5-3.1_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/squidclient_2.2.5-3.1_alpha.deb
arm:: http://security.debian.org/dists/stable/updates/main/binary-arm/squid-cgi_2.2.5-3.1_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/squid_2.2.5-3.1_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/squidclient_2.2.5-3.1_arm.deb
i386:: http://security.debian.org/dists/stable/updates/main/binary-i386/squid-cgi_2.2.5-3.1_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/squid_2.2.5-3.1_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/squidclient_2.2.5-3.1_i386.deb
m68k:: http://security.debian.org/dists/stable/updates/main/binary-m68k/squid-cgi_2.2.5-3.1_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/squid_2.2.5-3.1_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/squidclient_2.2.5-3.1_m68k.deb
powerpc:: http://security.debian.org/dists/stable/updates/main/binary-powerpc/squid-cgi_2.2.5-3.1_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/squid_2.2.5-3.1_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/squidclient_2.2.5-3.1_powerpc.deb
sparc:: http://security.debian.org/dists/stable/updates/main/binary-sparc/squid-cgi_2.2.5-3.1_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/squid_2.2.5-3.1_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/squidclient_2.2.5-3.1_sparc.deb