Issued:: 2008-04-08
Updated:: 2008-04-08

RHSA-2008:0214 - Security Advisory

Overview
Updated Packages

Synopsis

Moderate: squid security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated squid packages that fix a security issue are now available for Red
Hat Enterprise Linux 2.1, 3, 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

Squid is a high-performance proxy caching server for Web clients,
supporting FTP, gopher, and HTTP data objects.

A flaw was found in the way squid manipulated HTTP headers for cached
objects stored in system memory. An attacker could use this flaw to cause a
squid child process to exit. This interrupted existing connections and made
proxy services unavailable. Note: the parent squid process started a new
child process, so this attack only resulted in a temporary denial of
service. (CVE-2008-1612)

Users of squid are advised to upgrade to these updated packages, which
contain a backported patch to resolve this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

Red Hat Enterprise Linux Server 5 x86_64
Red Hat Enterprise Linux Server 5 ia64
Red Hat Enterprise Linux Server 5 i386
Red Hat Enterprise Linux Server 4 x86_64
Red Hat Enterprise Linux Server 4 ia64
Red Hat Enterprise Linux Server 4 i386
Red Hat Enterprise Linux Server 3 x86_64
Red Hat Enterprise Linux Server 3 ia64
Red Hat Enterprise Linux Server 3 i386
Red Hat Enterprise Linux Server 2 ia64
Red Hat Enterprise Linux Server 2 i386
Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.1 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.1 ia64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.1 i386
Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.6 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.6 ia64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.6 i386
Red Hat Enterprise Linux Workstation 5 x86_64
Red Hat Enterprise Linux Workstation 5 i386
Red Hat Enterprise Linux Workstation 4 x86_64
Red Hat Enterprise Linux Workstation 4 ia64
Red Hat Enterprise Linux Workstation 4 i386
Red Hat Enterprise Linux Workstation 3 x86_64
Red Hat Enterprise Linux Workstation 3 ia64
Red Hat Enterprise Linux Workstation 3 i386
Red Hat Enterprise Linux Workstation 2 ia64
Red Hat Enterprise Linux Desktop 4 x86_64
Red Hat Enterprise Linux Desktop 4 i386
Red Hat Enterprise Linux Desktop 3 x86_64
Red Hat Enterprise Linux Desktop 3 i386
Red Hat Enterprise Linux for IBM z Systems 5 s390x
Red Hat Enterprise Linux for IBM z Systems 4 s390x
Red Hat Enterprise Linux for IBM z Systems 4 s390
Red Hat Enterprise Linux for IBM z Systems 3 s390x
Red Hat Enterprise Linux for IBM z Systems 3 s390
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.1 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.6 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.6 s390
Red Hat Enterprise Linux for Power, big endian 5 ppc
Red Hat Enterprise Linux for Power, big endian 4 ppc
Red Hat Enterprise Linux for Power, big endian 3 ppc
Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.1 ppc
Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.6 ppc
Red Hat Enterprise Linux Server from RHUI 5 x86_64
Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

BZ - 439801 - CVE-2008-1612 squid: regression in SQUID-2007:2 / CVE-2007-6239

CVEs

CVE-2008-1612

References

http://www.redhat.com/security/updates/classification/#moderate

Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux Server 5

SRPM
x86_64
squid-2.6.STABLE6-5.el5_1.3.x86_64.rpm	SHA-256: a8cbded177f9024b62f47b359d1ff9bb86a661aeb8212beddb801dfa453806aa
ia64
squid-2.6.STABLE6-5.el5_1.3.ia64.rpm	SHA-256: 060e4165e68b222ef25a564c40763a230d2004fdb62d2bb69b9f3d0e6515228f
i386
squid-2.6.STABLE6-5.el5_1.3.i386.rpm	SHA-256: 6a6d0ac5bd28de3899a5ddd33e15595ffe376707f26dab90bdbb8a0f040ce8a0

Red Hat Enterprise Linux Server 4

SRPM
x86_64
squid-2.5.STABLE14-1.4E.el4_6.2.x86_64.rpm	SHA-256: ce74c0fb4c74f09cf513c3146888cfa65984dcf81fda8a2d854266366f19e18b
squid-2.5.STABLE14-1.4E.el4_6.2.x86_64.rpm	SHA-256: ce74c0fb4c74f09cf513c3146888cfa65984dcf81fda8a2d854266366f19e18b
ia64
squid-2.5.STABLE14-1.4E.el4_6.2.ia64.rpm	SHA-256: c25cb178789cafd4cc8093aa0637a043bb777840d180254864328680b1340be2
squid-2.5.STABLE14-1.4E.el4_6.2.ia64.rpm	SHA-256: c25cb178789cafd4cc8093aa0637a043bb777840d180254864328680b1340be2
i386
squid-2.5.STABLE14-1.4E.el4_6.2.i386.rpm	SHA-256: 0ca54b04ccd6933bb3ccee65ae47dded8d90a74a8e3dab0f5664a093fda2b866
squid-2.5.STABLE14-1.4E.el4_6.2.i386.rpm	SHA-256: 0ca54b04ccd6933bb3ccee65ae47dded8d90a74a8e3dab0f5664a093fda2b866

Red Hat Enterprise Linux Server 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Server 2

SRPM
ia64
i386

Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.1

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.6

SRPM
x86_64
squid-2.5.STABLE14-1.4E.el4_6.2.x86_64.rpm	SHA-256: ce74c0fb4c74f09cf513c3146888cfa65984dcf81fda8a2d854266366f19e18b
squid-2.5.STABLE14-1.4E.el4_6.2.x86_64.rpm	SHA-256: ce74c0fb4c74f09cf513c3146888cfa65984dcf81fda8a2d854266366f19e18b
ia64
squid-2.5.STABLE14-1.4E.el4_6.2.ia64.rpm	SHA-256: c25cb178789cafd4cc8093aa0637a043bb777840d180254864328680b1340be2
squid-2.5.STABLE14-1.4E.el4_6.2.ia64.rpm	SHA-256: c25cb178789cafd4cc8093aa0637a043bb777840d180254864328680b1340be2
i386
squid-2.5.STABLE14-1.4E.el4_6.2.i386.rpm	SHA-256: 0ca54b04ccd6933bb3ccee65ae47dded8d90a74a8e3dab0f5664a093fda2b866
squid-2.5.STABLE14-1.4E.el4_6.2.i386.rpm	SHA-256: 0ca54b04ccd6933bb3ccee65ae47dded8d90a74a8e3dab0f5664a093fda2b866

Red Hat Enterprise Linux Workstation 5

SRPM
x86_64
squid-2.6.STABLE6-5.el5_1.3.x86_64.rpm	SHA-256: a8cbded177f9024b62f47b359d1ff9bb86a661aeb8212beddb801dfa453806aa
i386
squid-2.6.STABLE6-5.el5_1.3.i386.rpm	SHA-256: 6a6d0ac5bd28de3899a5ddd33e15595ffe376707f26dab90bdbb8a0f040ce8a0

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
squid-2.5.STABLE14-1.4E.el4_6.2.x86_64.rpm	SHA-256: ce74c0fb4c74f09cf513c3146888cfa65984dcf81fda8a2d854266366f19e18b
ia64
squid-2.5.STABLE14-1.4E.el4_6.2.ia64.rpm	SHA-256: c25cb178789cafd4cc8093aa0637a043bb777840d180254864328680b1340be2
i386
squid-2.5.STABLE14-1.4E.el4_6.2.i386.rpm	SHA-256: 0ca54b04ccd6933bb3ccee65ae47dded8d90a74a8e3dab0f5664a093fda2b866

Red Hat Enterprise Linux Workstation 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Workstation 2

SRPM
ia64

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
squid-2.5.STABLE14-1.4E.el4_6.2.x86_64.rpm	SHA-256: ce74c0fb4c74f09cf513c3146888cfa65984dcf81fda8a2d854266366f19e18b
i386
squid-2.5.STABLE14-1.4E.el4_6.2.i386.rpm	SHA-256: 0ca54b04ccd6933bb3ccee65ae47dded8d90a74a8e3dab0f5664a093fda2b866

Red Hat Enterprise Linux Desktop 3

SRPM
x86_64
i386

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
s390x
squid-2.6.STABLE6-5.el5_1.3.s390x.rpm	SHA-256: 247f3ba2bfbf8ffdfe4a813b9af368e41e86ab52f724bc3ef078c18bd7a730c4

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
squid-2.5.STABLE14-1.4E.el4_6.2.s390x.rpm	SHA-256: 2f1dfcc9a5cfdd850366f6a6d7045fab33ec15a81d2480c720ab9c911ced5fd0
s390
squid-2.5.STABLE14-1.4E.el4_6.2.s390.rpm	SHA-256: 1a054bd1d1737af7d15e85fef4591b38e5ef505bd9e9f6b70227b412d7d8030d

Red Hat Enterprise Linux for IBM z Systems 3

SRPM
s390x
s390

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.1

SRPM
s390x

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.6

SRPM
s390x
squid-2.5.STABLE14-1.4E.el4_6.2.s390x.rpm	SHA-256: 2f1dfcc9a5cfdd850366f6a6d7045fab33ec15a81d2480c720ab9c911ced5fd0
s390
squid-2.5.STABLE14-1.4E.el4_6.2.s390.rpm	SHA-256: 1a054bd1d1737af7d15e85fef4591b38e5ef505bd9e9f6b70227b412d7d8030d

Red Hat Enterprise Linux for Power, big endian 5

SRPM
ppc
squid-2.6.STABLE6-5.el5_1.3.ppc.rpm	SHA-256: 507da7f43584d2dfc57f0f45320ffe7dd8bd5a145e7a30bbf86928dfa2c0ca2e

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
squid-2.5.STABLE14-1.4E.el4_6.2.ppc.rpm	SHA-256: a1230ba81c644876b18e7755b108ed99afde6d6ad57b0b08c81dba5f379f514b

Red Hat Enterprise Linux for Power, big endian 3

SRPM
ppc

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.1

SRPM
ppc

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.6

SRPM
ppc
squid-2.5.STABLE14-1.4E.el4_6.2.ppc.rpm	SHA-256: a1230ba81c644876b18e7755b108ed99afde6d6ad57b0b08c81dba5f379f514b

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
squid-2.6.STABLE6-5.el5_1.3.x86_64.rpm	SHA-256: a8cbded177f9024b62f47b359d1ff9bb86a661aeb8212beddb801dfa453806aa
i386
squid-2.6.STABLE6-5.el5_1.3.i386.rpm	SHA-256: 6a6d0ac5bd28de3899a5ddd33e15595ffe376707f26dab90bdbb8a0f040ce8a0

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.