Bug 92254 – net-proxy/squid: Unspecified DNS Spoofing Vulnerability

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Robert Paskowitz (RETIRED) 2005-05-11 08:49:42 UTC]

From SecurityFocus:

Squid Proxy is prone to an unspecified DNS spoofing vulnerability. This could allow malicious users to perform DNS spoofing attacks on Squid Proxy clients on unprotected networks.

This issue affects Squid Proxy versions 2.5 and earlier. 
-------------------

A patch against 2.5.STABLE9 is available at http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE9-dns_query-4.patch

[Comment 1 Robert Paskowitz (RETIRED) 2005-05-11 08:56:26 UTC]

net-proxy, please advise. There is also a release candidate from today that likely has the patch in it, not sure when STABLE10 is expected to be released though.

[Comment 2 Alin Năstac (RETIRED) 2005-05-11 11:38:37 UTC]

looks like a serious problem to me.

version bumped to 2.5.10_rc3 and marked stable on x86

P.S. I'm a little annoyed about the negligence of the upstream regarding the quality of the inter-release patches. It is the second time when I had problems appliying official patches to the latest official release.
I thought it is better to use the rc3 tarball - who knows what else is missing from the published patches?

[Comment 3 Sune Kloppenborg Jeppesen (RETIRED) 2005-05-11 14:06:58 UTC]

Arches please test and mark stable.

[Comment 4 Lars Weiler (RETIRED) 2005-05-11 15:11:40 UTC]

ppc stable.

[Comment 5 Markus Rothe (RETIRED) 2005-05-11 23:37:15 UTC]

stable on ppc64

[Comment 6 Jan Brinkmann (RETIRED) 2005-05-12 09:08:42 UTC]

stable on amd64

[Comment 7 Michael Hanselmann (hansmi) (RETIRED) 2005-05-12 11:42:07 UTC]

Stable on hppa.

[Comment 8 Matthias Geerdsen (RETIRED) 2005-05-12 13:27:09 UTC]

http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query

Malicious users may spoof DNS lookups if the DNS client UDP port (random, assigned by OS at startup) is unfiltered and your network is not protected from IP spoofing.

__

http://www.securitytracker.com/alerts/2005/May/1013952.html

[Comment 9 Bryan Østergaard (RETIRED) 2005-05-12 13:34:52 UTC]

Stable on alpha + ia64.

[Comment 10 Gustavo Zacarias (RETIRED) 2005-05-12 16:16:28 UTC]

sparc stable.

[Comment 11 Alin Năstac (RETIRED) 2005-05-12 21:06:48 UTC]

submitted with x86 from the beggining

[Comment 12 Sune Kloppenborg Jeppesen (RETIRED) 2005-05-12 22:01:35 UTC]

[Comment 13 Sune Kloppenborg Jeppesen (RETIRED) 2005-05-12 22:01:35 UTC]

½ YES vote.

[Comment 14 Sune Kloppenborg Jeppesen (RETIRED) 2005-05-13 01:53:59 UTC]

Other Squid issues in the queue (both very minor imho):

bug #89149
bug #83955

[Comment 15 Matthias Geerdsen (RETIRED) 2005-05-13 12:03:27 UTC]

Half vote against a GLSA, but hard to decide... We do have 3 in the queue though now... So one should be considered now or after the next issue.

[Comment 16 Thierry Carrez (RETIRED) 2005-05-14 01:22:28 UTC]

I half-vote NO too, but I agree the next one is the good one.

[Comment 17 Sune Kloppenborg Jeppesen (RETIRED) 2005-05-14 03:02:11 UTC]

Lets queue this. Reverting to full NO for the time being->Closing.

[Comment 18 Hardave Riar (RETIRED) 2005-07-02 14:12:13 UTC]

Stable on mips.