Bug 3959 - squid is missing security update for CVE-2011-4096
Summary: squid is missing security update for CVE-2011-4096
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 1
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard:
Keywords: Triaged, validated_update
Depends on:
Blocks:
 
Reported: 2011-12-31 00:25 CET by David Walser
Modified: 2012-01-04 13:58 CET (History)
5 users (show)

See Also:
Source RPM: squid-3.1.15-1.2.mga1.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2011-12-31 00:25:36 CET
Mandriva issued this advisory on December 27:
http://lists.mandriva.com/security-announce/2011-12/msg00024.php
Comment 1 Manuel Hiebel 2011-12-31 13:18:04 CET
Hi, thanks for reporting this bug.
Assigned to the package maintainer.

(Please set the status to 'assigned' if you are working on it)

Keywords: (none) => Triaged
Assignee: bugsquad => dlucio

Comment 2 D Morgan 2012-01-02 03:39:45 CET
pushed in the BS

CC: (none) => dmorganec
Assignee: dlucio => qa-bugs

Comment 3 David Walser 2012-01-04 01:52:07 CET
Tested successfully on i586.
Comment 4 Dave Hodgins 2012-01-04 01:58:53 CET
Also testing on i586.  Before installing the update, trying to load
http://l15.sphotos.l3.fbcdn.net/ gets an error connecting to the http proxy,
with the message
squid[6073]: Squid Parent: child process 6076 exited due to signal 6 with status 0
showing up in syslog.

After installing the update, squid returns a page with the message
"The requested URL could not be retrieved".

Looks good.

CC: (none) => davidwhodgins

Comment 5 David GEIGER 2012-01-04 09:45:32 CET
Tested complete on Mageia release 1 (Official) for x86_64 with the testing procedure of comment 4 ,for me it's good too,work well.

CC: (none) => geiger.david68210

Comment 6 claire robinson 2012-01-04 10:07:44 CET
Validating the update

Advisory
-----------------
This security update for Squid corrects the following vulnerability

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4096

The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record. 

https://bugs.mageia.org/show_bug.cgi?id=3959
-------------------

SRPM: squid-3.1.15-1.3.mga1

Could sysadmin please push from core/updates_testing to core/updates

Thankyou!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs
Hardware: i586 => All

Comment 7 Thomas Backlund 2012-01-04 13:58:05 CET
update pushed

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.