Bug#607379: DoS in TCP DNS lookups when IPv6 is disabled on the system

2010-12-20 Thread e-t172
On 20/12/2010 10:21, e-t172 wrote: Thanks, this patch indeed fixes the bug. It doesn't apply cleanly to the Debian source package, though; that's why I backported it. The attached patch should apply correctly to Debian squid3_3.1.6-1.2. Strike my last, I backported the wrong patch… (revno 10722

Bug#607379: DoS in TCP DNS lookups when IPv6 is disabled on the system

2010-12-20 Thread e-t172
On 20/12/2010 03:10, Amos Jeffries wrote: Ah you would be needing this as well I think: http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10063.patch (upstream bug 3011) Thanks, this patch indeed fixes the bug. It doesn't apply cleanly to the Debian source package, though; that'

Bug#607379: DoS in TCP DNS lookups when IPv6 is disabled on the system

2010-12-19 Thread Amos Jeffries
Ah you would be needing this as well I think: http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10063.patch (upstream bug 3011) That patch labeled as CVE was a bug-fix on top of other code. This sets up the background state on which it was built and should be included in the

Bug#607379: DoS in TCP DNS lookups when IPv6 is disabled on the system

2010-12-18 Thread e-t172
On 20:59, Amos Jeffries wrote: This DNS failure is a DoS condition triggerable by internal clients. The patch as supplied earlier makes Squid treat IPv6 addresses as IPv4 ones and leaves the hole open when the system is configured in split-stack mode. The correct upstream patch can be found at:

Bug#607379: DoS in TCP DNS lookups when IPv6 is disabled on the system

2010-12-17 Thread Amos Jeffries
Severity: critical Tags: patch upstream This DNS failure is a DoS condition triggerable by internal clients. The patch as supplied earlier makes Squid treat IPv6 addresses as IPv4 ones and leaves the hole open when the system is configured in split-stack mode. The correct upstream patch can