[Full-disclosure] [ MDVSA-2010:033 ] squid

Les derniers commentaires publiés sur SecuObs (1-5):

- ESRT @mikkohypponen @carnal0wnage - Spoofing your Foursquare location with Me - ESRT @mikkohypponen - Yes, that just might work, license plate SQL injection - ESRT @mikkohypponen The Android phone with a Win32 USB worm on it's memory ca - opennhrp 0.11.5 - Mozilla confirmed a critical vulnerability in the newest version of Firefox Les derniers commentaires publiés sur SecuObs (6-25) Tous les commentaires publiés sur SecuObs avant les 5 derniers

[Message Precedent sur la mailing][Message Suivant sur la mailing][Precedent dans le fil][Prochain dans le fil][Index par Date][Index par fil] [Full-disclosure] [ MDVSA-2010:033 ] squid

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________ Mandriva Linux Security Advisory MDVSA-2010:033 link://[click] ________________________ Package : squid Date : February 5, 2010 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0, Enterprise Server 5.0, Multi Network Firewall 2.0 ________________________ Problem Description: A vulnerability have been discovered and corrected in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15, which allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header (CVE-2010-0308).

This update provides a fix to this vulnerability.

________________________ References: link://[click] ________________________ Updated Packages: Mandriva Linux 2008.0: 56d1a099888684549450987984ab07e5 2008.0/i586/squid-2.6.STABLE16-1.5mdv2008.0.i586.rpm 23ae7f244ee664020270c010d9bffc93 2008.0/i586/squid-cachemgr-2.6.STABLE16-1.5mdv2008.0.i586.rpm 952676e8f79dcb3cf48beb693082a055 2008.0/SRPMS/squid-2.6.STABLE16-1.5mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 6e3757e4957a31a2c7b2c698d70a23ec 2008.0/x86_64/squid-2.6.STABLE16-1.5mdv2008.0.x86_64.rpm 4090afb42b9c821567ef9585f72826de 2008.0/x86_64/squid-cachemgr-2.6.STABLE16-1.5mdv2008.0.x86_64.rpm 952676e8f79dcb3cf48beb693082a055 2008.0/SRPMS/squid-2.6.STABLE16-1.5mdv2008.0.src.rpm Mandriva Linux 2009.0: 514ac3e366722bf224c6c268133c8bf5 2009.0/i586/squid-3.0-22.2mdv2009.0.i586.rpm af1e6999474f66abd50c0830838c37e1 2009.0/i586/squid-cachemgr-3.0-22.2mdv2009.0.i586.rpm 111816fac7c13dac76fc4cbb32c5d5b8 2009.0/SRPMS/squid-3.0-22.2mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 26a88dff2af3b818c765740a226a304a 2009.0/x86_64/squid-3.0-22.2mdv2009.0.x86_64.rpm 63f5a3ca8f76e30fd55b3d0491161b29 2009.0/x86_64/squid-cachemgr-3.0-22.2mdv2009.0.x86_64.rpm 111816fac7c13dac76fc4cbb32c5d5b8 2009.0/SRPMS/squid-3.0-22.2mdv2009.0.src.rpm Mandriva Linux 2009.1: ac595f8e4d801933fa14c9737f2bda2f 2009.1/i586/squid-3.0-22.2mdv2009.1.i586.rpm 62de73c22f47725da6c437364a46e940 2009.1/i586/squid-cachemgr-3.0-22.2mdv2009.1.i586.rpm c7e94a138db6a4c1388229755aee5140 2009.1/SRPMS/squid-3.0-22.2mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: 90303168b09d33f47bce7242b669a214 2009.1/x86_64/squid-3.0-22.2mdv2009.1.x86_64.rpm cd8aaa4a61c8ecdb5170bd9cc0d3c1f3 2009.1/x86_64/squid-cachemgr-3.0-22.2mdv2009.1.x86_64.rpm c7e94a138db6a4c1388229755aee5140 2009.1/SRPMS/squid-3.0-22.2mdv2009.1.src.rpm Mandriva Linux 2010.0: eddb97e4799437f2cf0a78c6a359cb5e 2010.0/i586/squid-3.0-22.2mdv2010.0.i586.rpm 555c13ad31b3b6aacd50bbfcb6fa9eef 2010.0/i586/squid-cachemgr-3.0-22.2mdv2010.0.i586.rpm 7f79b208080e8e3ead74b69e7ac840e5 2010.0/SRPMS/squid-3.0-22.2mdv2010.0.src.rpm Mandriva Linux 2010.0/X86_64: a13f8f1b479b99bdc40ddc5ad86d0be4 2010.0/x86_64/squid-3.0-22.2mdv2010.0.x86_64.rpm d648754975631b54d6bc992a0e39cbae 2010.0/x86_64/squid-cachemgr-3.0-22.2mdv2010.0.x86_64.rpm 7f79b208080e8e3ead74b69e7ac840e5 2010.0/SRPMS/squid-3.0-22.2mdv2010.0.src.rpm Corporate 4.0: 0bd70b523f3e0d4d6a3b61b3e42997d1 corporate/4.0/i586/squid-2.6.STABLE1-4.7.20060mlcs4.i586.rpm 934c278650d457d10adda359441432e2 corporate/4.0/i586/squid-cachemgr-2.6.STABLE1-4.7.20060mlcs4.i586.rpm 357f99500713686172ab432852f9d3c2 corporate/4.0/SRPMS/squid-2.6.STABLE1-4.7.20060mlcs4.src.rpm Corporate 4.0/X86_64: 18b0b7e594cbab3d6c19a1a017b7d4b0 corporate/4.0/x86_64/squid-2.6.STABLE1-4.7.20060mlcs4.x86_64.rpm a22aace447ac83f960fa58fa7e8a1329 corporate/4.0/x86_64/squid-cachemgr-2.6.STABLE1-4.7.20060mlcs4.x86_64.rpm 357f99500713686172ab432852f9d3c2 corporate/4.0/SRPMS/squid-2.6.STABLE1-4.7.20060mlcs4.src.rpm Mandriva Enterprise Server 5: 0672692de71c27f8f39e9908b3738c41 mes5/i586/squid-3.0-22.2mdvmes5.i586.rpm 369ada9958ee2314f05c521ebcfdf538 mes5/i586/squid-cachemgr-3.0-22.2mdvmes5.i586.rpm c016e10f40be982e8721bd25d7cbde2b mes5/SRPMS/squid-3.0-22.2mdvmes5.src.rpm Mandriva Enterprise Server 5/X86_64: ed47df165089fab968431ca1530e609e mes5/x86_64/squid-3.0-22.2mdvmes5.x86_64.rpm 52c1eefa1b67c95d50ade95e2b37b4ae mes5/x86_64/squid-cachemgr-3.0-22.2mdvmes5.x86_64.rpm c016e10f40be982e8721bd25d7cbde2b mes5/SRPMS/squid-3.0-22.2mdvmes5.src.rpm Multi Network Firewall 2.0: e42b3292a67b734d582f565ffb7376ce mnf/2.0/i586/squid-2.5.STABLE9-1.11.M20mdk.i586.rpm 288d79b7fa0bdf3e3c3ae17b65a661ac mnf/2.0/SRPMS/squid-2.5.STABLE9-1.11.M20mdk.src.rpm ________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: link://[click] If you want to report vulnerabilities, please contact security_(at)_mandriva.com ________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFLbETtmqjQ0CJFipgRAgrOAKDfmBXv7ZKffTKHwH71Zq8CanAv3QCg3gT2 QstUAAOi99OUju/Jgx1QWm4= =GZzx -----END PGP SIGNATURE----- Full-Disclosure - We believe in it.

Charter: link://[click] Hosted and sponsored by Secunia - link://[click]

Precedent par Date: Re: [Full-disclosure] about jit and dep+aslr
Suivant par Date: [Full-disclosure] [CORE-2010-0121] Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Servers
Precedent par fil : [Full-disclosure] Secunia Research: libmikmod Module Parsing Vulnerabilities
Suivant par fil : [Full-disclosure] [CORE-2010-0121] Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Servers
Index(s):
- Date
- Fil

Archives de la liste de diffusion Secunia
Archives de la liste de diffusion BugTraq
Archives de la liste de diffusion DailyDave
Archives de la liste de diffusion FunSec
Archives de la liste de diffusion Full Disclosure
Archives de la liste de diffusion Focus-IDS (FD)
Archives de la liste de diffusion Webappsec (FD)
Archives de la liste de diffusion Security-basics (FD)
Archives de la liste de diffusion Vulndiscuss
Archives de la liste de diffusion Vulnwatch

Les derniers commentaires publiés sur SecuObs (6-25):

- libnids 1.24 - XSSer Automate your XSS Injections - Cross Application Scripting All you KDE are belong to US - ESRT @ChrisJohnRiley @carnal0wnage - Exploiting hard filtered SQL Injections - Malicious Code Evolution from IE Zero-Day Exploit Code - Google Releases Skipfish Application Security Scanner - ESRT @securityninja - Burp Suite Tutorial - Repeater and Comparer Tool - ESRT @dinodaizovi - New metasploit blog post - analyzes the first public Perm - ESRT @iagox86 @hdmoore - Using Metasploit to Locate and Exploit the Energizer - ESRT @innismir - New Weblog Post -- Finding Malware on your network via cache - Sniffing with Wireshark as a Non-Root User - Focus on MacNikto v1.1.1 - New Google Chrome v4.1.249.1036 released, fixes multiple security vulnerabili - ESRT @opexxx @synopsi - Remote stack overflows - ESRT @postmodern_mod3 @tmm1 - memprof now displays stack frames and threads - ESRT @_MDL_ @gollmann - Locking botnet agents to specific victim systems in o - CsFire 0.4.1 autonomously protects against dangerous or malicious cross-domai - Seccubus v1.4.1 - Nessus 4.2 compatibility release - ESRT @JGamblin @threatpost - Hackers say they will definitely break into an A - ESRT @hdmoore @iagox86 - Weaponizing dnscat - first version of dnscat shellco Les cinq derniers commentaires publiés sur SecuObs Tous les commentaires publiés sur SecuObs avant les 25 derniers

SecuToolBox :

Bluetooth Stack Smasher v0.6 / Bluetooth Stack Smasher v0.8 / Slides Bluetooth Eurosec 2006 / Exposé vidéo Windows Shellcode - Kostya Kortchinsky / Exposé audio Reverse Engineering - Nicolas Brulez / Exposé vidéo Securitech - Pierre Betouin / WEP aircrack + Ubiquiti (MadWifi) 300 mW + Yagi / Secure WIFI WPA + EAP-TLS + Freeradius / Audit Windows / Captive Password Windows / USBDumper / USBDumper 2 / Hacking Hardware / WishMaster backdoor / DNS Auditing Tool / Ettercap SSL MITM / Exploit vulnérabilités Windows / Memory Dumper Kernel Hardening / Reverse Engineering / Scapy / SecUbuLIVE CD / Metasploit / eEye Blink Sec Center / eEye Retina Scanner + d'outils / + de tutoriels

Mini-Tagwall des articles publiés sur SecuObs :

sécurité, exploit, windows, microsoft, réseau, attaque, outil, vulnérabilité, audit, système, virus, internet, données, présentation, metasploit, linux, bluetooth, protocol, vista, scanner, réseaux, shell, engineering, rootkit, paquet, conférence, trames, wishmaster, téléphone, source, sysun, noyau, mobile, https, mémoire, rapport, botnet, téléphones, libre, reverse, navigateur, patch, snort, scapy, intel + de mots clés avec l'annuaire des articles publiés sur SecuObs

Archives Failles Secunia :

- SA39038 SiteDone Custom Edition articleId SQL Injection Vulnerability - SA38977 Ubuntu update for thunderbird - SA38930 Debian update for php5 - SA39044 IBM HTTP Server Multiple Vulnerabilities - SA38929 CA ARCserve Backup JRE Multiple Vulnerabilities + d'archives failles avec Secunia et SecuMail

Archives Mailing Full Disclosure :

- Full-disclosure Claude Mercier/CLSC-CHSLD BVLV/Reg03/SSSS est absent(e). - Full-disclosure Setting the record straight on The Return of Koobface - Full-disclosure Malware 2010 Call for Papers - Re: Full-disclosure Fingerprinting Paper with Laser - Re: Full-disclosure Fingerprinting Paper with Laser + d'archives Full Disclosure avec SecuMail

Archives Mailing Bugtraq :

- announcing skipfish, an automated web app security scanner - Vulnerability Httpdx v1.5.3b - IBM Lotus 6.x HTTP Response Splitting Vulnerability - There are lost of xss vul in PHPWind v6.0 ! - CA20100318-01: Security Notice for CA ARCserve Backup - SECURITY DSA-2018-1 New php5 packages fix null pointer dereference + d'archives Bugtraq avec SecuMail

Mini-Tagwall de l'annuaire video :

vmware, security, virus, biometric, windows, lockpicking, password, botnet, metasploit, tutorial, attack, crypt, linux, network, iphone, server, exploit, wimax, conficker, virtu, virtual, engineering, shmoocon, cisco, reverse, wireshark, ettercap, hacker, firewall, internet, knoppix, rootkit, arduino, wireless, conference, source, backtrack, openbsd, brucon, systm, overflow, openssh, access, buffer, remote + de mots clés avec l'annuaire des videos

Mini-Tagwall des articles de la revue de presse :

security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité + de mots clés avec l'annuaire de la revue de presse

Mini-Tagwall des Tweets de la revue Twitter :

security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack + de mots clés avec l'annuaire de la revue Twitter