English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 148472 CVE descriptions
and 72306 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 --------------------------------------------------------------------------
   Turbolinux Security Advisory TLSA-2009-27
   http://www.turbolinux.co.jp/security/
                                             security-team@turbolinux.co.jp
 --------------------------------------------------------------------------

 Original released date: 30 Sep 2009
 Last revised: 30 Sep 2009

 Package: squid

 Summary: Squid denial of service attack

 More information:
    Squid is a high-performance proxy caching server for web clients,
    supporting FTP, gopher and HTTP data objects.  Unlike traditional
    caching software, Squid handles all requests in a single, non-blocking,
    I/O-driven process.

    The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows
    remote attackers to cause a denial of service via a crafted auth header
    with certain comma delimiters that trigger an infinite loop of calls to
    the strcspn function. (CVE-2009-2855)

 Affected Products:
    - Turbolinux Appliance Server 3.0 x64 Edition
    - Turbolinux Appliance Server 3.0
    - Turbolinux 11 Server x64 Edition
    - Turbolinux 11 Server
    - Turbolinux Appliance Server 2.0
    - Turbolinux 10 Server x64 Edition
    - Turbolinux 10 Server


 <Turbolinux Appliance Server 3.0 x64 Edition>

   Source Packages
   Size: MD5

   squid-2.6.STABLE16-7.src.rpm
      1326040 e63fb8c6b52233c3f638ff99c356b6a3

   Binary Packages
   Size: MD5

   squid-2.6.STABLE16-7.x86_64.rpm
       998537 b2c03087fcf5e6f9497977395ec87b99

 <Turbolinux Appliance Server 3.0>

   Source Packages
   Size: MD5

   squid-2.6.STABLE16-7.src.rpm
      1326040 e63fb8c6b52233c3f638ff99c356b6a3

   Binary Packages
   Size: MD5

   squid-2.6.STABLE16-7.i686.rpm
       946464 bc74d6473d88e5c0886d07e24e510385

 <Turbolinux 11 Server x64 Edition>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/11/updates/SRPMS/squid-2.6.STABLE16-7.src.rpm
      1326040 e63fb8c6b52233c3f638ff99c356b6a3

   Binary Packages
   Size: MD5

   squid-2.6.STABLE16-7.x86_64.rpm
       998537 b2c03087fcf5e6f9497977395ec87b99

 <Turbolinux 11 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/11/updates/SRPMS/squid-2.6.STABLE16-7.src.rpm
      1326040 e63fb8c6b52233c3f638ff99c356b6a3

   Binary Packages
   Size: MD5

   squid-2.6.STABLE16-7.i686.rpm
       946464 bc74d6473d88e5c0886d07e24e510385

 <Turbolinux Appliance Server 2.0>

   Source Packages
   Size: MD5

   squid-2.5.STABLE10-9.src.rpm
      1569483 9f0f5595f3fc42c99eb0b709f39829f4

   Binary Packages
   Size: MD5

   squid-2.5.STABLE10-9.i586.rpm
       882743 40176b92027f241c2d93c4622dde728e

 <Turbolinux 10 Server x64 Edition>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/SRPMS/squid-2.5.STABLE10-9.src.rpm
      1569483 9f0f5595f3fc42c99eb0b709f39829f4

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/squid-2.5.STABLE10-9.x86_64.rpm
       956309 50e70ae06a9d32872336db5914bb8832
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/squid-debug-2.5.STABLE10-9.x86_64.rpm
      1544329 4d204cd9262bd966ccc709d87692773a

 <Turbolinux Appliance Server 1.0 Workgroup Edition>

   Source Packages
   Size: MD5

   squid-2.5.STABLE10-9.src.rpm
      1569525 b58e08e6103b27e9be043e7479049024

   Binary Packages
   Size: MD5

   squid-2.5.STABLE10-9.i586.rpm
       857149 d69878abe1c7b5077b6b97a434c13479

 <Turbolinux 10 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/SRPMS/squid-2.5.STABLE10-9.src.rpm
      1569483 9f0f5595f3fc42c99eb0b709f39829f4

   Binary Packages
   Size: MD5

   squid-2.5.STABLE10-9.i586.rpm
       882743 40176b92027f241c2d93c4622dde728e
   squid-debug-2.5.STABLE10-9.i586.rpm
      1550878 16f2e010e66eb132532c92d8a816392f


 References:

 CVE
   [CVE-2009-2855]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2855

 --------------------------------------------------------------------------
 Revision History
    30 Sep 2009 Initial release
 --------------------------------------------------------------------------

 Copyright(C) 2009 Turbolinux, Inc. All rights reserved. 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (GNU/Linux)

iEYEARECAAYFAkrDJIEACgkQK0LzjOqIJMxB6QCgt8qCD2kn37oTIFkrefhIt+Qp
KwsAn2wDACUpDj4OHmoSEFr6gOi9Tp2j
=50bp
-----END PGP SIGNATURE-----

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Developer APIs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe

© 1998-2019 E-Soft Inc. All rights reserved.