From:	 dburcaw@newhope.terraplex.com
To:	 yellowdog-updates@lists.yellowdoglinux.com
Subject: [yellowdog-updates] Yellow Dog Linux Security Advisory: YDL-20020305-1
Date:	 5 Mar 2002 11:07:15 -0000

Yellow Dog Linux Security Announcement
--------------------------------------

Package:	squid	
Issue Date: 	March 05, 2002	
Priority:	high		
Advisory ID: 	YDU-20020305-2


1. 	Topic:

	New squid packages are available that fix many
	vulnerabilities including a denial of service (DoS)
	attack.


2. 	Problem:

	"Squid is a high-performance proxy caching server.  Various security issues
	have been found in Squid up to and including version 2.4.STABLE2.  These were:

	- a memory leak in the SNMP code
	- a crash on specially-formatted data in FTP URL parsing
	- HTCP would still be active, even if it was disabled in the config file

	These errata pacakges contain Squid version 2.4.STABLE3, which is not
	vulnerable to these issues.  It is recommended that all users of Squid
	update to the fixed packages. 

	Note: SNMP support is disabled in the
	default configuration of these packages (it was previously enabled).
	If you need SNMP support, edit your squid configuration and change
	the 'snmp_port' option; the default port for SNMP enabled-squid is
	3401.

	Thanks go to Jouko Pynnonen for notifying us of the FTP vulnerability and
	to the Squid team for providing patches.

	The Common Vulnerabilities and Exposures project (cve.mitre.org) has
	assigned the names CAN-2002-0067, CAN-2002-0068, CAN-2002-0069 to these issues."
	(from Red Hat's advisory)



3. 	Solution:

   	a) Updating via yup...
   	We suggest that you use the Yellow Dog Update Program (yup)
   	to keep your system up-to-date. The following command(s) will
   	automatically retrieve and install the fixed version of
   	this update onto your system:

   		yup update squid 

   	b) Updating manually...
   	The update can also be retrieved manually from our ftp site
   	below along with the rpm command that should be used to install
   	the update.  (Please use a mirror site)

   		ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.1/ppc/
		rpm -Fvh squid-2.4.STABLE3-1.7.0.ppc.rpm


4. Verification

MD5 checksum			  Package
--------------------------------  ----------------------------
6f8f7c0c790de090b1a33ad08834f489  ppc/squid-2.4.STABLE3-1.7.0.ppc.rpm
f41382375ab6a8002c6fd4de08ba2af0  SRPMS/squid-2.4.STABLE3-1.7.0.src.rpm

If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename


5. Misc.

Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.

For information regarding the usage of yup, the Yellow Dog Update Program, see 
http://http://www.yellowdoglinux.com/support/solutions/ydl_general/yup.shtml