rhsa-2013_0505
Vulnerability from csaf_redhat
Published
2013-02-20 16:19
Modified
2024-11-05 17:59
Summary
Red Hat Security Advisory: squid security and bug fix update

Notes

Topic
Updated squid packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
Squid is a high-performance proxy caching server for web clients that supports FTP, Gopher, and HTTP data objects. A denial of service flaw was found in the way the Squid Cache Manager processed certain requests. A remote attacker who is able to access the Cache Manager CGI could use this flaw to cause Squid to consume an excessive amount of memory. (CVE-2012-5643) This update also fixes the following bugs: * Due to a bug in the ConnStateData::noteMoreBodySpaceAvailable() function, child processes of Squid terminated upon encountering a failed assertion. An upstream patch has been provided and Squid child processes no longer terminate. (BZ#805879) * Due to an upstream patch, which renamed the HTTP header controlling persistent connections from "Proxy-Connection" to "Connection", the NTLM pass-through authentication does not work, thus preventing login. This update adds the new "http10" option to the squid.conf file, which can be used to enable the change in the patch. This option is set to "off" by default. When set to "on", the NTLM pass-through authentication works properly, thus allowing login attempts to succeed. (BZ#844723) * When the IPv6 protocol was disabled and Squid tried to handle an HTTP GET request containing an IPv6 address, the Squid child process terminated due to signal 6. This bug has been fixed and such requests are now handled as expected. (BZ#832484) * The old "stale if hit" logic did not account for cases where the stored stale response became fresh due to a successful re-validation with the origin server. Consequently, incorrect warning messages were returned. Now, Squid no longer marks elements as stale in the described scenario. (BZ#847056) * When squid packages were installed before samba-winbind, the wbpriv group did not include Squid. Consequently, NTLM authentication calls failed. Now, Squid correctly adds itself into the wbpriv group if samba-winbind is installed before Squid, thus fixing this bug. (BZ#797571) * In FIPS mode, Squid was using private MD5 hash functions for user authentication and network access. As MD5 is incompatible with FIPS mode, Squid could fail to start. This update limits the use of the private MD5 functions to local disk file hash identifiers, thus allowing Squid to work in FIPS mode. (BZ#833086) * Under high system load, the squid process could terminate unexpectedly with a segmentation fault during reboot. This update provides better memory handling during reboot, thus fixing this bug. (BZ#782732) * Squid incorrectly set the timeout limit for client HTTP connections with the value for server-side connections, which is much higher, thus creating unnecessary delays. With this update, Squid uses a proper value for the client timeout limit. (BZ#798090) * Squid did not properly release allocated memory when generating error page contents, which caused memory leaks. Consequently, the Squid proxy server consumed a lot of memory within a short time period. This update fixes this memory leak. (BZ#758861) * Squid did not pass the ident value to a URL rewriter that was configured using the "url_rewrite_program" directive. Consequently, the URL rewriter received the dash character ("–") as the user value instead of the correct user name. Now, the URL rewriter receives the correct user name in the described scenario. (BZ#797884) * Squid, used as a transparent proxy, can only handle the HTTP protocol. Previously, it was possible to define a URL in which the access protocol contained the asterisk character (*) or an unknown protocol namespace URI. Consequently, an "Invalid URL" error message was logged to access.log during reload. This update ensures that "http://" is always used in transparent proxy URLs, and the error message is no longer logged in this scenario. (BZ#720504) All users of squid are advised to upgrade to these updated packages, which fix these issues. After installing this update, the squid service will be restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated squid packages that fix one security issue and several bugs are now\navailable for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Squid is a high-performance proxy caching server for web clients that\nsupports FTP, Gopher, and HTTP data objects.\n\nA denial of service flaw was found in the way the Squid Cache Manager\nprocessed certain requests. A remote attacker who is able to access the\nCache Manager CGI could use this flaw to cause Squid to consume an\nexcessive amount of memory. (CVE-2012-5643)\n\nThis update also fixes the following bugs:\n\n* Due to a bug in the ConnStateData::noteMoreBodySpaceAvailable() function,\nchild processes of Squid terminated upon encountering a failed assertion.\nAn upstream patch has been provided and Squid child processes no longer\nterminate. (BZ#805879)\n\n* Due to an upstream patch, which renamed the HTTP header controlling\npersistent connections from \"Proxy-Connection\" to \"Connection\", the NTLM\npass-through authentication does not work, thus preventing login. This\nupdate adds the new \"http10\" option to the squid.conf file, which can be\nused to enable the change in the patch. This option is set to \"off\" by\ndefault. When set to \"on\", the NTLM pass-through authentication works\nproperly, thus allowing login attempts to succeed. (BZ#844723)\n\n* When the IPv6 protocol was disabled and Squid tried to handle an HTTP GET\nrequest containing an IPv6 address, the Squid child process terminated due\nto signal 6. This bug has been fixed and such requests are now handled as\nexpected. (BZ#832484)\n\n* The old \"stale if hit\" logic did not account for cases where the stored\nstale response became fresh due to a successful re-validation with the\norigin server. Consequently, incorrect warning messages were returned. Now,\nSquid no longer marks elements as stale in the described scenario.\n(BZ#847056)\n\n* When squid packages were installed before samba-winbind, the wbpriv group\ndid not include Squid. Consequently, NTLM authentication calls failed. Now,\nSquid correctly adds itself into the wbpriv group if samba-winbind is\ninstalled before Squid, thus fixing this bug. (BZ#797571)\n\n* In FIPS mode, Squid was using private MD5 hash functions for user\nauthentication and network access. As MD5 is incompatible with FIPS mode,\nSquid could fail to start. This update limits the use of the private MD5\nfunctions to local disk file hash identifiers, thus allowing Squid to work\nin FIPS mode. (BZ#833086)\n\n* Under high system load, the squid process could terminate unexpectedly\nwith a segmentation fault during reboot. This update provides better memory\nhandling during reboot, thus fixing this bug. (BZ#782732)\n\n* Squid incorrectly set the timeout limit for client HTTP connections with\nthe value for server-side connections, which is much higher, thus creating\nunnecessary delays. With this update, Squid uses a proper value for the\nclient timeout limit. (BZ#798090)\n\n* Squid did not properly release allocated memory when generating error\npage contents, which caused memory leaks. Consequently, the Squid proxy\nserver consumed a lot of memory within a short time period. This update\nfixes this memory leak. (BZ#758861)\n\n* Squid did not pass the ident value to a URL rewriter that was configured\nusing the \"url_rewrite_program\" directive. Consequently, the URL rewriter\nreceived the dash character (\"\u2013\") as the user value instead of the correct\nuser name. Now, the URL rewriter receives the correct user name in the\ndescribed scenario. (BZ#797884)\n\n* Squid, used as a transparent proxy, can only handle the HTTP protocol.\nPreviously, it was possible to define a URL in which the access protocol\ncontained the asterisk character (*) or an unknown protocol namespace URI.\nConsequently, an \"Invalid URL\" error message was logged to access.log\nduring reload. This update ensures that \"http://\" is always used in\ntransparent proxy URLs, and the error message is no longer logged in this\nscenario. (BZ#720504)\n\nAll users of squid are advised to upgrade to these updated packages, which\nfix these issues. After installing this update, the squid service will be\nrestarted automatically.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0505",
        "url": "https://access.redhat.com/errata/RHSA-2013:0505"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.4_Technical_Notes/squid.html",
        "url": "https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.4_Technical_Notes/squid.html"
      },
      {
        "category": "external",
        "summary": "797571",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=797571"
      },
      {
        "category": "external",
        "summary": "798090",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=798090"
      },
      {
        "category": "external",
        "summary": "832484",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=832484"
      },
      {
        "category": "external",
        "summary": "833086",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=833086"
      },
      {
        "category": "external",
        "summary": "844723",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=844723"
      },
      {
        "category": "external",
        "summary": "847056",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847056"
      },
      {
        "category": "external",
        "summary": "887962",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=887962"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0505.json"
      }
    ],
    "title": "Red Hat Security Advisory: squid security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-05T17:59:44+00:00",
      "generator": {
        "date": "2024-11-05T17:59:44+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2013:0505",
      "initial_release_date": "2013-02-20T16:19:00+00:00",
      "revision_history": [
        {
          "date": "2013-02-20T16:19:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-02-20T16:30:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T17:59:44+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squid-7:3.1.10-16.el6.src",
                "product": {
                  "name": "squid-7:3.1.10-16.el6.src",
                  "product_id": "squid-7:3.1.10-16.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=src\u0026epoch=7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squid-7:3.1.10-16.el6.x86_64",
                "product": {
                  "name": "squid-7:3.1.10-16.el6.x86_64",
                  "product_id": "squid-7:3.1.10-16.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=x86_64\u0026epoch=7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squid-debuginfo-7:3.1.10-16.el6.x86_64",
                "product": {
                  "name": "squid-debuginfo-7:3.1.10-16.el6.x86_64",
                  "product_id": "squid-debuginfo-7:3.1.10-16.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=x86_64\u0026epoch=7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squid-7:3.1.10-16.el6.i686",
                "product": {
                  "name": "squid-7:3.1.10-16.el6.i686",
                  "product_id": "squid-7:3.1.10-16.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=i686\u0026epoch=7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squid-debuginfo-7:3.1.10-16.el6.i686",
                "product": {
                  "name": "squid-debuginfo-7:3.1.10-16.el6.i686",
                  "product_id": "squid-debuginfo-7:3.1.10-16.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=i686\u0026epoch=7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squid-7:3.1.10-16.el6.s390x",
                "product": {
                  "name": "squid-7:3.1.10-16.el6.s390x",
                  "product_id": "squid-7:3.1.10-16.el6.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=s390x\u0026epoch=7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squid-debuginfo-7:3.1.10-16.el6.s390x",
                "product": {
                  "name": "squid-debuginfo-7:3.1.10-16.el6.s390x",
                  "product_id": "squid-debuginfo-7:3.1.10-16.el6.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=s390x\u0026epoch=7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squid-7:3.1.10-16.el6.ppc64",
                "product": {
                  "name": "squid-7:3.1.10-16.el6.ppc64",
                  "product_id": "squid-7:3.1.10-16.el6.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=ppc64\u0026epoch=7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squid-debuginfo-7:3.1.10-16.el6.ppc64",
                "product": {
                  "name": "squid-debuginfo-7:3.1.10-16.el6.ppc64",
                  "product_id": "squid-debuginfo-7:3.1.10-16.el6.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=ppc64\u0026epoch=7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:squid-7:3.1.10-16.el6.i686"
        },
        "product_reference": "squid-7:3.1.10-16.el6.i686",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:squid-7:3.1.10-16.el6.ppc64"
        },
        "product_reference": "squid-7:3.1.10-16.el6.ppc64",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:squid-7:3.1.10-16.el6.s390x"
        },
        "product_reference": "squid-7:3.1.10-16.el6.s390x",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.1.10-16.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:squid-7:3.1.10-16.el6.src"
        },
        "product_reference": "squid-7:3.1.10-16.el6.src",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:squid-7:3.1.10-16.el6.x86_64"
        },
        "product_reference": "squid-7:3.1.10-16.el6.x86_64",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-debuginfo-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:squid-debuginfo-7:3.1.10-16.el6.i686"
        },
        "product_reference": "squid-debuginfo-7:3.1.10-16.el6.i686",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-debuginfo-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64"
        },
        "product_reference": "squid-debuginfo-7:3.1.10-16.el6.ppc64",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-debuginfo-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x"
        },
        "product_reference": "squid-debuginfo-7:3.1.10-16.el6.s390x",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-debuginfo-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64"
        },
        "product_reference": "squid-debuginfo-7:3.1.10-16.el6.x86_64",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:squid-7:3.1.10-16.el6.i686"
        },
        "product_reference": "squid-7:3.1.10-16.el6.i686",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:squid-7:3.1.10-16.el6.ppc64"
        },
        "product_reference": "squid-7:3.1.10-16.el6.ppc64",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:squid-7:3.1.10-16.el6.s390x"
        },
        "product_reference": "squid-7:3.1.10-16.el6.s390x",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.1.10-16.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:squid-7:3.1.10-16.el6.src"
        },
        "product_reference": "squid-7:3.1.10-16.el6.src",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:squid-7:3.1.10-16.el6.x86_64"
        },
        "product_reference": "squid-7:3.1.10-16.el6.x86_64",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-debuginfo-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686"
        },
        "product_reference": "squid-debuginfo-7:3.1.10-16.el6.i686",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-debuginfo-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64"
        },
        "product_reference": "squid-debuginfo-7:3.1.10-16.el6.ppc64",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-debuginfo-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x"
        },
        "product_reference": "squid-debuginfo-7:3.1.10-16.el6.s390x",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-debuginfo-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64"
        },
        "product_reference": "squid-debuginfo-7:3.1.10-16.el6.x86_64",
        "relates_to_product_reference": "6Workstation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-5643",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "discovery_date": "2012-12-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "887962"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "squid: cachemgr.cgi memory usage DoS and memory leaks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server:squid-7:3.1.10-16.el6.i686",
          "6Server:squid-7:3.1.10-16.el6.ppc64",
          "6Server:squid-7:3.1.10-16.el6.s390x",
          "6Server:squid-7:3.1.10-16.el6.src",
          "6Server:squid-7:3.1.10-16.el6.x86_64",
          "6Server:squid-debuginfo-7:3.1.10-16.el6.i686",
          "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64",
          "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x",
          "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64",
          "6Workstation:squid-7:3.1.10-16.el6.i686",
          "6Workstation:squid-7:3.1.10-16.el6.ppc64",
          "6Workstation:squid-7:3.1.10-16.el6.s390x",
          "6Workstation:squid-7:3.1.10-16.el6.src",
          "6Workstation:squid-7:3.1.10-16.el6.x86_64",
          "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686",
          "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64",
          "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x",
          "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5643"
        },
        {
          "category": "external",
          "summary": "RHBZ#887962",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=887962"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5643",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5643"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5643",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5643"
        }
      ],
      "release_date": "2012-12-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-02-20T16:19:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server:squid-7:3.1.10-16.el6.i686",
            "6Server:squid-7:3.1.10-16.el6.ppc64",
            "6Server:squid-7:3.1.10-16.el6.s390x",
            "6Server:squid-7:3.1.10-16.el6.src",
            "6Server:squid-7:3.1.10-16.el6.x86_64",
            "6Server:squid-debuginfo-7:3.1.10-16.el6.i686",
            "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64",
            "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x",
            "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64",
            "6Workstation:squid-7:3.1.10-16.el6.i686",
            "6Workstation:squid-7:3.1.10-16.el6.ppc64",
            "6Workstation:squid-7:3.1.10-16.el6.s390x",
            "6Workstation:squid-7:3.1.10-16.el6.src",
            "6Workstation:squid-7:3.1.10-16.el6.x86_64",
            "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686",
            "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64",
            "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x",
            "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0505"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server:squid-7:3.1.10-16.el6.i686",
            "6Server:squid-7:3.1.10-16.el6.ppc64",
            "6Server:squid-7:3.1.10-16.el6.s390x",
            "6Server:squid-7:3.1.10-16.el6.src",
            "6Server:squid-7:3.1.10-16.el6.x86_64",
            "6Server:squid-debuginfo-7:3.1.10-16.el6.i686",
            "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64",
            "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x",
            "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64",
            "6Workstation:squid-7:3.1.10-16.el6.i686",
            "6Workstation:squid-7:3.1.10-16.el6.ppc64",
            "6Workstation:squid-7:3.1.10-16.el6.s390x",
            "6Workstation:squid-7:3.1.10-16.el6.src",
            "6Workstation:squid-7:3.1.10-16.el6.x86_64",
            "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686",
            "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64",
            "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x",
            "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "squid: cachemgr.cgi memory usage DoS and memory leaks"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.