RHSA-2011:0545: Low: squid security and bug fix update
Squid is a high-performance proxy caching server for web clients,supporting FTP, Gopher, and HTTP data objects.It was found that string comparison functions in Squid did not properlyhandle the comparisons of NULL and empty strings. A remote, trusted webclient could use this flaw to cause the squid daemon to crash via aspecially-crafted request. (CVE-2010-3072)This update also fixes the following bugs: A small memory leak in Squid caused multiple "ctx: enter level" messages to be logged to "/var/log/squid/cache.log". This update resolves the memoryleak. (BZ#666533) This erratum upgrades Squid to upstream version 3.1.10. This upgraded version supports the Google Instant service and introduces various codeimprovements. (BZ#639365)Users of squid should upgrade to this updated package, which resolves theseissues. After installing this update, the squid service will be restartedautomatically.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2011:0545?
RHSA-2011:0545 has been classified as a moderate severity vulnerability.
How do I fix RHSA-2011:0545?
To fix RHSA-2011:0545, upgrade the squid package to version 3.1.10-1.el6 or later.
Who is affected by RHSA-2011:0545?
RHSA-2011:0545 affects users running specific versions of the Squid proxy caching server.
What type of vulnerability is RHSA-2011:0545?
RHSA-2011:0545 is a vulnerability related to improper handling of string comparisons in Squid.
Can RHSA-2011:0545 be exploited remotely?
Yes, a remote, trusted web client could exploit RHSA-2011:0545 due to improper handling of NULL and empty strings.