Yellow Dog Linux Security Announcement -------------------------------------- Package: squid Issue Date: March 05, 2002 Priority: high Advisory ID: YDU-20020305-2 1. Topic: New squid packages are available that fix many vulnerabilities including a denial of service (DoS) attack. 2. Problem: "Squid is a high-performance proxy caching server. Various security issues have been found in Squid up to and including version 2.4.STABLE2. These were: - a memory leak in the SNMP code - a crash on specially-formatted data in FTP URL parsing - HTCP would still be active, even if it was disabled in the config file These errata pacakges contain Squid version 2.4.STABLE3, which is not vulnerable to these issues. It is recommended that all users of Squid update to the fixed packages. Note: SNMP support is disabled in the default configuration of these packages (it was previously enabled). If you need SNMP support, edit your squid configuration and change the 'snmp_port' option; the default port for SNMP enabled-squid is 3401. Thanks go to Jouko Pynnonen for notifying us of the FTP vulnerability and to the Squid team for providing patches. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2002-0067, CAN-2002-0068, CAN-2002-0069 to these issues." (from Red Hat's advisory) 3. Solution: a) Updating via yup... We suggest that you use the Yellow Dog Update Program (yup) to keep your system up-to-date. The following command(s) will automatically retrieve and install the fixed version of this update onto your system: yup update squid b) Updating manually... The update can also be retrieved manually from our ftp site below along with the rpm command that should be used to install the update. (Please use a mirror site) ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.1/ppc/ rpm -Fvh squid-2.4.STABLE3-1.7.0.ppc.rpm 4. Verification MD5 checksum Package -------------------------------- ---------------------------- 6f8f7c0c790de090b1a33ad08834f489 ppc/squid-2.4.STABLE3-1.7.0.ppc.rpm f41382375ab6a8002c6fd4de08ba2af0 SRPMS/squid-2.4.STABLE3-1.7.0.src.rpm If you wish to verify that each package has not been corrupted or tampered with, examine the md5sum with the following command: rpm --checksig --nogpg filename 5. Misc. Terra Soft has setup a moderated mailing list where these security, bugfix, and package enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more information. For information regarding the usage of yup, the Yellow Dog Update Program, see http://http://www.yellowdoglinux.com/support/solutions/ydl_general/yup.shtml