Ubuntu Security Notice USN-67-1
20th January, 2005
squid vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 4.10
Details
infamous41md discovered several Denial of Service vulnerabilities in
squid.
A malicious Gopher server could crash squid by sending a line bigger
than 4096 bytes. (CAN-2005-0094)
If squid is configured to send WCPP (Web Cache Communication Protocol)
messages to a "home router", an attacker who was able to send UDP
packets with a forged source address of this router could crash the
erver with a specially crafted WCPP message. (CAN-2005-0095)
Previous versions of squid have a memory leak which gradually cause
memory exhaustion and eventual termination. (CAN-2005-0096)
A remote attacker could crash the server by sending a specially
crafted NTLM type 3 packet. (CAN-2005-0097)
Update instructions
The problem can be corrected by updating your system to the following package version:
- Ubuntu 4.10:
- squid
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
None