Home / vulnerabilities Mandriva Linux Security Advisory 2013-129
Posted on 12 April 2013
Source : packetstormsecurity.org Link
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2013:129
http://www.mandriva.com/en/support/security/
_______________________________________________________________________
Package : squid
Date : April 10, 2013
Affected: Business Server 1.0
_______________________________________________________________________
Problem Description:
Updated squid packages fix security vulnerability:
Due to missing input validation, the Squid cachemgr.cgi tool in Squid
before 3.1.22 and 3.2.4 is vulnerable to a denial of service attack
when processing specially crafted requests (CVE-2012-5643).
It was discovered that the patch for CVE-2012-5643 was incorrect. A
remote attacker could exploit this flaw to perform a denial of service
attack (CVE-2013-0189).
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5643
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0189
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0029
_______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64:
03f4a33d16e0ccb13c2b825fa9739e3c mbs1/x86_64/squid-3.1.19-5.2.mbs1.x86_64.rpm
0844295e6c832b20b53a89a6570bd632 mbs1/x86_64/squid-cachemgr-3.1.19-5.2.mbs1.x86_64.rpm
721e597deda6926578f64dd31b0df387 mbs1/SRPMS/squid-3.1.19-5.2.mbs1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFRZVfUmqjQ0CJFipgRAnhlAJ9orRIWER7dyp+HiX7vCDKsHuQv9QCfXOiO
vh6AUMKiHIKi6QunM9En6Yg=
=RwvM
-----END PGP SIGNATURE-----
