A denial of service problem in Squid3 initiated via invalid Content-Length headers and memory leaks has been fixed. (CVE-2012-5643 / CVE-2013-0189, SQUID-2012:1)

Also a logrotate permission issue has been fixed.

The remote host is affected by the vulnerability described in GLSA-201309-22 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to bypass ACL restrictions or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This is security update that fixes multiple memory leaks in cachemgr tool. (CVE-2013-0189)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A denial of service problem in Squid via invalid Content-Length headers and memory leaks has been fixed. (CVE-2012-5643 / CVE-2013-0189, SQUID-2012:1)

Also a logrotate permission issue has been fixed.

Updated squid packages fix security vulnerability :

Due to missing input validation, the Squid cachemgr.cgi tool in Squid before 3.1.22 and 3.2.4 is vulnerable to a denial of service attack when processing specially crafted requests (CVE-2012-5643).

It was discovered that the patch for CVE-2012-5643 was incorrect. A remote attacker could exploit this flaw to perform a denial of service attack (CVE-2013-0189).

It was discovered that squid's cachemgr.cgi was vulnerable to excessive resource use. A remote attacker could exploit this flaw to perform a denial of service attack on the server and other hosted services. (CVE-2012-5643)

It was discovered that the patch for CVE-2012-5643 was incorrect. A remote attacker could exploit this flaw to perform a denial of service attack. (CVE-2013-0189).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Squid3, a fully featured Web proxy cache, is prone to a denial of service attack due to memory consumption caused by memory leaks in cachemgr.cgi :

  - CVE-2012-5643     squid's cachemgr.cgi was vulnerable to excessive     resource use. A remote attacker could exploit this flaw     to perform a denial of service attack on the server and     other hosted services.

  - CVE-2013-0189     The original patch for CVE-2012-5643 was incomplete. A     remote attacker still could exploit this flaw to perform     a denial of service attack.

ID	名稱	產品	系列	已發布	已更新	嚴重性
64889	SuSE 11.2 Security Update : squid3 (SAT Patch Number 7336)	Nessus	SuSE Local Security Checks	2013/2/26	2021/1/19	medium
70182	GLSA-201309-22 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2013/9/28	2021/1/6	high
64514	Fedora 17 : squid-3.2.5-2.fc17 (2013-1625)	Nessus	Fedora Local Security Checks	2013/2/10	2021/1/11	medium
64864	SuSE 11.2 Security Update : squid (SAT Patch Number 7335)	Nessus	SuSE Local Security Checks	2013/2/24	2021/1/19	medium
66141	Mandriva Linux Security Advisory : squid (MDVSA-2013:129)	Nessus	Mandriva Local Security Checks	2013/4/20	2021/1/6	medium
64376	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : squid, squid3 vulnerabilities (USN-1713-1)	Nessus	Ubuntu Local Security Checks	2013/1/31	2019/9/19	medium
64867	Debian DSA-2631-1 : squid3 - denial of service	Nessus	Debian Local Security Checks	2013/2/25	2021/1/11	medium

偵測

搜尋 Plugin

medium

high

medium

medium

medium

medium

medium