Mageia Bugzilla – Bug 8794
squid new security issue: incomplete fix for CVE-2012-5643 (CVE-2013-0189)
Last modified: 2013-02-06 23:03:35 CET
"Jan Lieskovsky 2013-01-16 07:05:21 EST
Originally, Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5643 (bug #887962) to the following vulnerability:
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 126.96.36.199 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
Later it was found the upstream patch for CVE-2012-5643 issue to be incomplete, resulting in new patchset:
The CVE identifier of CVE-2013-0189 has been assigned to this new issue (and new patchset)."
fixed in r391672 (mga2, updates_testing, squid-3.1.19-4.2.mga2)
squid-3.2.6 in cauldron is unaffected.
Ubuntu has issued an advisory on January 30:
Updated squid packages fix security vulnerability:
It was discovered that the patch for CVE-2012-5643 was incorrect. A
remote attacker could exploit this flaw to perform a denial of service
Updated packages in core/updates_testing:
No PoC so just testing it works.
Testing mga2 64
Testing complete mga2 64
Testing complete mga2 32
Advisory & SRPM in comment 3
Can sysadmin please push from core/updates_testing to core/updates
Forgot to mention, patch checked into Mageia 1 SVN.