Test ID:	1.3.6.1.4.1.25623.1.0.53268
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-576-1)
Summary:	The remote host is missing an update for the Debian 'squid' package(s) announced via the DSA-576-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'squid' package(s) announced via the DSA-576-1 advisory. Vulnerability Insight: Several security vulnerabilities have been discovered in Squid, the internet object cache, the popular WWW proxy cache. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-1999-0710 It is possible to bypass access lists and scan arbitrary hosts and ports in the network through cachemgr.cgi, which is installed by default. This update disables this feature and introduces a configuration file (/etc/squid/cachemgr.conf) to control this behavior. CAN-2004-0918 The asn_parse_header function (asn1.c) in the SNMP module for Squid allows remote attackers to cause a denial of service via certain SNMP packets with negative length fields that causes a memory allocation error. For the stable distribution (woody) these problems have been fixed in version 2.4.6-2woody4. For the unstable distribution (sid) these problems have been fixed in version 2.5.7-1. We recommend that you upgrade your squid package. Affected Software/OS: 'squid' package(s) on Debian 3.0. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-1999-0710 BugTraq ID: 2059 http://www.securityfocus.com/bid/2059 Bugtraq: 19990725 Redhat 6.0 cachemgr.cgi lameness (Google Search) Debian Security Information: DSA-576 (Google Search) http://www.debian.org/security/2004/dsa-576 http://www.redhat.com/archives/fedora-announce-list/2005-May/msg00025.html http://fedoranews.org/updates/FEDORA--.shtml http://www.redhat.com/support/errata/RHSA-1999-025.html http://www.redhat.com/support/errata/RHSA-2005-489.html XForce ISS Database: http-cgi-cachemgr(2385) https://exchange.xforce.ibmcloud.com/vulnerabilities/2385 Common Vulnerability Exposure (CVE) ID: CVE-2004-0918 BugTraq ID: 11385 http://www.securityfocus.com/bid/11385 Conectiva Linux advisory: CLA-2005:923 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000923 https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00122.html http://www.gentoo.org/security/en/glsa/glsa-200410-15.xml http://www.idefense.com/application/poi/display?id=152&type=vulnerabilities&flashstatus=false http://marc.info/?l=bugtraq&m=109913064629327&w=2 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10931 http://www.redhat.com/support/errata/RHSA-2004-591.html SCO Security Bulletin: SCOSA-2005.16 ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.16/SCOSA-2005.16.txt http://secunia.com/advisories/30914 http://secunia.com/advisories/30967 SuSE Security Announcement: SUSE-SR:2008:014 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html http://www.vupen.com/english/advisories/2008/1969/references XForce ISS Database: squid-snmp-asnparseheader-dos(17688) https://exchange.xforce.ibmcloud.com/vulnerabilities/17688
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.