Bug 14004 - squid new security issue CVE-2014-3609
Summary: squid new security issue CVE-2014-3609
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/609836/
Whiteboard: MGA3TOO has_procedure advisory MGA4-3...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2014-08-28 18:50 CEST by David Walser
Modified: 2014-09-05 11:08 CEST (History)
3 users (show)

See Also:
Source RPM: squid-3.3.12-1.mga4.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2014-08-28 18:50:08 CEST
Ubuntu has issued an advisory on August 27:
http://www.ubuntu.com/usn/usn-2327-1/

The issue is fixed upstream in 3.3.13 and 3.4.7 and there are patches.

Updated packages uploaded for Mageia 4 and Cauldron.

Patched package uploaded for Mageia 3.

Advisory:
========================

Updated squid packages fix security vulnerability:

Matthew Daley discovered that Squid 3 did not properly perform input
validation in request parsing. A remote attacker could send crafted Range
requests to cause a denial of service (CVE-2014-3609).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3609
http://www.squid-cache.org/Advisories/SQUID-2014_2.txt
http://www.squid-cache.org/mail-archive/squid-users/201408/0286.html
http://www.ubuntu.com/usn/usn-2327-1/
========================

Updated packages in core/updates_testing:
========================
squid-3.2.10-1.7.mga3
squid-cachemgr-3.2.10-1.7.mga3
squid-3.3.13-1.mga4
squid-cachemgr-3.3.13-1.mga4

from SRPMS:
squid-3.2.10-1.7.mga3.src.rpm
squid-3.3.13-1.mga4.src.rpm

Reproducible: 

Steps to Reproduce:
David Walser 2014-08-28 18:50:21 CEST

Whiteboard: (none) => MGA3TOO

Comment 1 Rémi Verschelde 2014-08-28 19:17:51 CEST
Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=13137#c3

CC: (none) => remi
Whiteboard: MGA3TOO => MGA3TOO has_procedure

Comment 2 Rémi Verschelde 2014-08-28 20:20:05 CEST
Testing complete on Mageia 4 32bit following the procedure in comment 1. Don't forget to install squid-cachemgr to be able to follow the procedure.

Whiteboard: MGA3TOO has_procedure => MGA3TOO has_procedure MGA4-32-OK

Comment 3 Rémi Verschelde 2014-08-28 22:30:57 CEST
Step by step procedure based on the one linked in comment 1 (if you're not confident yet with systemctl and all):

- Install squid and squid-cachemgr from core/updates_testing

- In your web browser, set up a HTTP proxy on localhost, using port 3128.
To do so in Firefox 24, go to Edit > Preferences > 
Advanced > Network > Settings... > Manual proxy configuration, and then configure as said previsouly.

- Start the apache (httpd) server and the squid caching server with (as root):
# systemctl start httpd
# systemctl start squid

- In your web browser, go to some websites using the HTTPS protocol, such as https://www.mageia.org

- The browse to http://localhost/cgi-bin/cachemgr.cgi
"Cache Manager Interface" should appear, asking for some information about your setup.

- Click on "Continue...". You should now see lots of links. Click on a few links at random, and just check that there is some cached content in those links.

- You're done :-)
Comment 4 Damyan Dimitrov 2014-09-01 14:05:40 CEST
Testing complete on Mageia 4 64bit, Mageia 3 32bit, Mageia3 64bit following the procedure.

Rémi Verschelde also completed the testing on Mageia 4 32bit, so I'm validating the update.

Could someone from the sysadmin team push this to updates

Thanks :)

Keywords: (none) => validated_update
Whiteboard: MGA3TOO has_procedure MGA4-32-OK => MGA3TOO has_procedure MGA4-32-OK MGA3-32-OK MGA3-64-OK MGA4-64-OK
CC: (none) => damyan.dimitrov, sysadmin-bugs

Comment 5 claire robinson 2014-09-01 15:52:42 CEST
Well done Damyan!

Advisory uploaded.

Whiteboard: MGA3TOO has_procedure MGA4-32-OK MGA3-32-OK MGA3-64-OK MGA4-64-OK => MGA3TOO has_procedure advisory MGA4-32-OK MGA3-32-OK MGA3-64-OK MGA4-64-OK

Comment 6 Mageia Robot 2014-09-05 11:08:41 CEST
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2014-0369.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.