USN-67-1: Squid vulnerabilities

Releases

• Ubuntu 4.10

Details

infamous41md discovered several Denial of Service vulnerabilities in
squid.

A malicious Gopher server could crash squid by sending a line bigger
than 4096 bytes. (CAN-2005-0094)

If squid is configured to send WCPP (Web Cache Communication Protocol)
messages to a "home router", an attacker who was able to send UDP
packets with a forged source address of this router could crash the

erver with a specially crafted WCPP message. (CAN-2005-0095)

Previous versions of squid have a memory leak which gradually cause
memory exhaustion and eventual termination. (CAN-2005-0096)

A remote attacker could crash the server by sending a specially
crafted NTLM type 3 packet. (CAN-2005-0097)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 4.10

• squid -

In general, a standard system update will make all the necessary changes.

References

• CVE-2005-0094
• CVE-2005-0095
• CVE-2005-0096
• CVE-2005-0097