Your message dated Mon, 07 Feb 2005 21:58:12 +0100
with message-id <[EMAIL PROTECTED]>
and subject line CAN-2005-0174 fixed
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 6 Feb 2005 19:44:14 +0000
>From [EMAIL PROTECTED] Sun Feb 06 11:44:14 2005
Return-path: <[EMAIL PROTECTED]>
Received: from kitenet.net [64.62.161.42] (postfix)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CxsKM-0005GQ-00; Sun, 06 Feb 2005 11:44:14 -0800
Received: from dragon.kitenet.net (unknown [66.168.94.144])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(Client CN "Joey Hess", Issuer "Joey Hess" (verified OK))
by kitenet.net (Postfix) with ESMTP id 234F217DD0
for <[EMAIL PROTECTED]>; Sun, 6 Feb 2005 19:44:13 +0000 (GMT)
Received: by dragon.kitenet.net (Postfix, from userid 1000)
id 79DEF6E4EB; Sun, 6 Feb 2005 14:46:36 -0500 (EST)
Date: Sun, 6 Feb 2005 14:46:35 -0500
From: Joey Hess <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: malformed HTTP header attacks (CAN-2005-0174)
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="gBBFr7Ir9EOA20Yy"
Content-Disposition: inline
X-Reportbug-Version: 3.7.1
User-Agent: Mutt/1.5.6+20040907i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--gBBFr7Ir9EOA20Yy
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Package: squid
Version: 2.5.7-4
Severity: grave
Tags: security
CAN-2005-0174 describes some security holes in squid:
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or
conduct certain attacks via headers that do not follow the HTTP specifica=
tion,
including (1) multiple Content-Length headers, (2) carriage return (CR)
characters that are not part of a CRLF pair, and (3) header names contain=
ing
whitespace characters.
Details and a patch here:
http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header=
_parsing
--=20
see shy jo
--gBBFr7Ir9EOA20Yy
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFCBnQbd8HHehbQuO8RAnLYAKC6YEl5a0fLjppRmC+2SdB9owMhtACfaDi/
cFqzwjIF8TJ0nlZmhjwIsb0=
=0TYa
-----END PGP SIGNATURE-----
--gBBFr7Ir9EOA20Yy--
---------------------------------------
Received: (at 293910-done) by bugs.debian.org; 7 Feb 2005 20:58:43 +0000
>From [EMAIL PROTECTED] Mon Feb 07 12:58:43 2005
Return-path: <[EMAIL PROTECTED]>
Received: from ms005msg.fastwebnet.it [213.140.2.50]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CyFxz-0008Ot-00; Mon, 07 Feb 2005 12:58:43 -0800
Received: from localhost.localdomain (23.21.172.54) by ms005msg.fastwebnet.it
(7.2.052.3)
id 41FFB24D001375AD for [EMAIL PROTECTED]; Mon, 7 Feb 2005 21:58:12
+0100
Received: by localhost.localdomain (Postfix, from userid 1000)
id DC4D34B917; Mon, 7 Feb 2005 21:58:12 +0100 (CET)
Subject: CAN-2005-0174 fixed
From: Luigi Gangitano <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
In-Reply-To: <[EMAIL PROTECTED]>
References: <[EMAIL PROTECTED]>
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="=-RVF6zSSVqgWb9oxbWtMY"
Organization: Debian
Date: Mon, 07 Feb 2005 21:58:12 +0100
Message-Id: <[EMAIL PROTECTED]>
Mime-Version: 1.0
X-Mailer: Evolution 2.0.3
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-3.0 required=4.0 tests=BAYES_00 autolearn=no
version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--=-RVF6zSSVqgWb9oxbWtMY
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
CAN-2005-0174 has been fixed in 2.5.7-6 with many other security issues.
Regards,
--=20
Luigi Gangitano -- <[EMAIL PROTECTED]> -- <[EMAIL PROTECTED]>
GPG: 1024D/924C0C26: 12F8 9C03 89D3 DB4A 9972 C24A F19B A618 924C 0C26
--=-RVF6zSSVqgWb9oxbWtMY
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: Questa parte del messaggio =?ISO-8859-1?Q?=E8?= firmata
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQBCB9Zk8ZumGJJMDCYRAo2yAJsGsWO5mdrelUMSaK4HKOR0GqyhpgCfYJsv
y9WWt2hrk3ifPvEt6dAhRt0=
=jcns
-----END PGP SIGNATURE-----
--=-RVF6zSSVqgWb9oxbWtMY--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
