Debian セキュリティ勧告
DSA-1991-1 squid/squid3 -- サービス拒否攻撃
- 報告日時:
- 2010-02-04
- 影響を受けるパッケージ:
- squid/squid3
- 危険性:
- あり
- 参考セキュリティデータベース:
- Debian バグ追跡システム: バグ 534982.
Mitre の CVE 辞書: CVE-2009-2855, CVE-2010-0308. - 詳細:
-
二つのサービス拒否攻撃に繋がる欠陥が web プロキシ squid および squid3 に発見されました。The Common Vulnerabilities and Exposures project は 以下の問題を認識しています。
- CVE-2009-2855
Bastian Blank さんにより、ある条件下でカンマデリミタを含む不正な auth ヘッダによりサービス拒否攻撃が可能であることが発見されました。
- CVE-2010-0308
Tomas Hoger さんにより、不正な DNS ヘッダのみのパケットによりサービス 拒否攻撃が可能であることが発見されました。
安定版 (stable) ディストリビューション (lenny) では、これらの問題はバ ージョン 2.7.STABLE3-4.1lenny1 の squid パッケージと、バージョン 3.0.STABLE8-3+lenny3 の squid3 パッケージで修正されています。
旧安定版 (oldstable) ディストリビューション (etch) では、これらの問題 はバージョン 2.6.5-6etch5 の squid パッケージと、バージョン 3.0.PRE5-5+etch2 の squid3 パッケージで修正されています。
テスト版 (squeeze) および不安定版 (unstable) ディストリビューションで は、これらの問題は近く修正予定です。
直ぐに squid/squid3 パッケージをアップグレードすることを勧めます。
- CVE-2009-2855
- 修正:
-
Debian GNU/Linux 4.0 (etch)
- ソース:
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5.diff.gz
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2.dsc
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5.orig.tar.gz
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2.diff.gz
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5.orig.tar.gz
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5.dsc
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2.dsc
- アーキテクチャ非依存コンポーネント:
- http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3.0.PRE5-5+etch2_all.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6.5-6etch5_all.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6.5-6etch5_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_alpha.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_alpha.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_alpha.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_alpha.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_alpha.deb
- http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_alpha.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_alpha.deb
- AMD64:
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_amd64.deb
- http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_amd64.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_amd64.deb
- http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_amd64.deb
- HP Precision:
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_hppa.deb
- http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_hppa.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_hppa.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_hppa.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_hppa.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_hppa.deb
- http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_hppa.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_i386.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_i386.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_i386.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_i386.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_i386.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_i386.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_ia64.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_ia64.deb
- http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_ia64.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_ia64.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_ia64.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_ia64.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_ia64.deb
- Little-endian MIPS:
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_mipsel.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_mipsel.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_mipsel.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_mipsel.deb
- http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_mipsel.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_mipsel.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_mipsel.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_s390.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_s390.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_s390.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_s390.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_s390.deb
- http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_s390.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch5_sparc.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_sparc.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch2_sparc.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch2_sparc.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch2_sparc.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch5_sparc.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch5_sparc.deb
Debian GNU/Linux 5.0 (lenny)
- ソース:
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1.diff.gz
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1.dsc
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3.orig.tar.gz
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3.dsc
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3.diff.gz
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8.orig.tar.gz
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1.dsc
- アーキテクチャ非依存コンポーネント:
- http://security.debian.org/pool/updates/main/s/squid/squid-common_2.7.STABLE3-4.1lenny1_all.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3.0.STABLE8-3+lenny3_all.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3.0.STABLE8-3+lenny3_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_alpha.deb
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_alpha.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_alpha.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_alpha.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_alpha.deb
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_alpha.deb
- AMD64:
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_amd64.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_amd64.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_amd64.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_amd64.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_amd64.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_amd64.deb
- ARM:
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_arm.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_arm.deb
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_arm.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_arm.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_arm.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_arm.deb
- ARM EABI:
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_armel.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_armel.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_armel.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_armel.deb
- HP Precision:
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_hppa.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_hppa.deb
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_hppa.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_hppa.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_hppa.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_hppa.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_i386.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_i386.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_i386.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_i386.deb
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_i386.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_ia64.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_ia64.deb
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_ia64.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_ia64.deb
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_ia64.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_ia64.deb
- Little-endian MIPS:
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_powerpc.deb
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_powerpc.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_powerpc.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_powerpc.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_powerpc.deb
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_s390.deb
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_s390.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_s390.deb
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STABLE3-4.1lenny1_sparc.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_sparc.deb
- http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3-4.1lenny1_sparc.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABLE8-3+lenny3_sparc.deb
- http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0.STABLE8-3+lenny3_sparc.deb
- http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.STABLE8-3+lenny3_sparc.deb
一覧にあるファイルの MD5 チェックサムは勧告の原文にあります。