Synopsis

Moderate: squid security update

Type/Severity

Security Advisory: Moderate

Topic

An update for squid is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

• It was found that the fix for CVE-2016-4051 released via RHSA-2016:1138 did not properly prevent the stack overflow in the munge_other_line() function. A remote attacker could send specially crafted data to the Squid proxy, which would exploit the cachemgr CGI utility, possibly triggering execution of arbitrary code. (CVE-2016-5408)
  

Red Hat would like to thank Amos Jeffries (Squid) for reporting this issue.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the squid service will be restarted automatically.

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64

Fixes

• BZ - 1359203 - CVE-2016-5408 squid: Buffer overflow vulnerability in cachemgr.cgi tool

CVEs

• CVE-2016-5408

References

• http://www.redhat.com/security/updates/classification/#normal

Red Hat Enterprise Linux Server 6

SRPM
squid-3.1.23-16.el6_8.6.src.rpm	SHA-256: 66849ab53a85e92201f963d66fe422390e051478ffba871791f3e5b8a8775b91
x86_64
squid-3.1.23-16.el6_8.6.x86_64.rpm	SHA-256: c0bd443a383ab8f52b7d054b2f68458f15259b3fa2e0279834ca5e13dbd088c5
squid-debuginfo-3.1.23-16.el6_8.6.x86_64.rpm	SHA-256: 2a230adf5219bac0d6feb1bf36c0776a25d712cbdf04030e377e858cf559d186
i386
squid-3.1.23-16.el6_8.6.i686.rpm	SHA-256: cbb990f756cf6089d4762de7b8bc6fa44f070d7a4d2fa4db771ab0210984f4dc
squid-debuginfo-3.1.23-16.el6_8.6.i686.rpm	SHA-256: 72f4beab1bf57036a6463b651b943dab272450fc6def769e81ed391612ffb889

Red Hat Enterprise Linux Workstation 6

SRPM
squid-3.1.23-16.el6_8.6.src.rpm	SHA-256: 66849ab53a85e92201f963d66fe422390e051478ffba871791f3e5b8a8775b91
x86_64
squid-3.1.23-16.el6_8.6.x86_64.rpm	SHA-256: c0bd443a383ab8f52b7d054b2f68458f15259b3fa2e0279834ca5e13dbd088c5
squid-debuginfo-3.1.23-16.el6_8.6.x86_64.rpm	SHA-256: 2a230adf5219bac0d6feb1bf36c0776a25d712cbdf04030e377e858cf559d186
i386
squid-3.1.23-16.el6_8.6.i686.rpm	SHA-256: cbb990f756cf6089d4762de7b8bc6fa44f070d7a4d2fa4db771ab0210984f4dc
squid-debuginfo-3.1.23-16.el6_8.6.i686.rpm	SHA-256: 72f4beab1bf57036a6463b651b943dab272450fc6def769e81ed391612ffb889

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
squid-3.1.23-16.el6_8.6.src.rpm	SHA-256: 66849ab53a85e92201f963d66fe422390e051478ffba871791f3e5b8a8775b91
s390x
squid-3.1.23-16.el6_8.6.s390x.rpm	SHA-256: 248a2c46563be2760309d0d3dda4fbd44ea7cee9ac712a934139bcecb75ddca4
squid-debuginfo-3.1.23-16.el6_8.6.s390x.rpm	SHA-256: e162dd6d854397d873de6280b94f6730b6f388d4da165cb0c4937454d8173d7e

Red Hat Enterprise Linux for Power, big endian 6

SRPM
squid-3.1.23-16.el6_8.6.src.rpm	SHA-256: 66849ab53a85e92201f963d66fe422390e051478ffba871791f3e5b8a8775b91
ppc64
squid-3.1.23-16.el6_8.6.ppc64.rpm	SHA-256: 501f7c6de6a195a7dc8ad4614c151154a40c599e61803701fda48ba27ee2c0fe
squid-debuginfo-3.1.23-16.el6_8.6.ppc64.rpm	SHA-256: efb553597962d411a3bf7ffb4fcd209b102c78a1827a5c55a5a5164910d97fee