| Description: | Description:
The remote host is missing updates announced in
advisory CLA-2004:838.
Squid is a full-featured web proxy cache.
Squid uses Access Control Lists (ACLs) to restrict access to sites or
users according to certain rules. This update fixes a
vulnerability[1] that allows a malicious user to bypass url_regex
ACLs by using a specially crafted URL containing the characters
'%00'. When interpreted by squid, only part of such a URL is
considered, potentially allowing the client to access prohibited
sites.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0189 to this issue[2].
Additionally, the packages for Conectiva Linux 9 are being updated to
the latest stable squid version (2.5STABLE5), which includes several
other fixes and improvements. One of the most notorious improvements
is the inclusion of a new Access Control type called urllogin. This
new configuration directive (which is not enabled by default) can be
used to protect vulnerable[3,4,5] Microsoft Internet Explorer(TM)
clients from accessing some malicious and specially crafted URLs.
Solution:
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'
http://www.squid-cache.org/Advisories/SQUID-2004_1.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0189
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1025
http://www.kb.cert.org/vuls/id/652278
http://www.microsoft.com/security/incident/spoof.asp
http://www.securityspace.com/smysecure/catid.html?in=CLA-2004:838
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002004
Risk factor : High
CVSS Score:
7.5
|
