Debian: DSA-2002-1: New polipo packages fix denial of service

    Date19 Feb 2010
    CategoryDebian
    46
    Posted ByLinuxSecurity Advisories
    Several denial of service vulnerabilities have been discovered in polipo, a small, caching web proxy. The Common Vulnerabilities and Exposures project identifies the following problems:
    
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-2002-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                           Stefan Fritsch
    February 19, 2010                     http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : polipo
    Vulnerability  : denial of service
    Problem type   : remote
    Debian-specific: no
    CVE Id(s)      : CVE-2009-3305 CVE-2009-4413
    Debian bug     : 547047 560779
    
    Several denial of service vulnerabilities have been discovered in polipo, a
    small, caching web proxy. The Common Vulnerabilities and Exposures project
    identifies the following problems:
    
    CVE-2009-3305
    
        A malicous remote sever could cause polipo to crash by sending an
        invalid Cache-Control header.
    
    CVE-2009-4143
    
        A malicous client could cause polipo to crash by sending a large
        Content-Length value.
    
    This upgrade also fixes some other bugs that could lead to a daemon crash
    or an infinite loop and may be triggerable remotely.
    
    For the stable distribution (lenny), these problems have been fixed in
    version 1.0.4-1+lenny1.
    
    For the testing distribution (squeeze) and the unstable distribution (sid),
    these problems have been fixed in version 1.0.4-3.
    
    
    We recommend that you upgrade your polipo packages.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 5.0 alias lenny (stable)
    - -----------------------------------------
    
    Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1.dsc
        Size/MD5 checksum:     1042 4bb50ed5472fcd6b264cb89816586bbe
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1.diff.gz
        Size/MD5 checksum:    13430 4cc90f3327e4018c56b4e140cbcb2f46
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4.orig.tar.gz
        Size/MD5 checksum:   180487 defdce7f8002ca68705b6c2c36c4d096
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_alpha.deb
        Size/MD5 checksum:   220166 1a352d494225a07a9073681be4bac47c
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_amd64.deb
        Size/MD5 checksum:   203454 381798d0cb7c64fc221bee69eb8b6a55
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_arm.deb
        Size/MD5 checksum:   201570 935d8f17f67c30c2910e057021d2c917
    
    armel architecture (ARM EABI)
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_armel.deb
        Size/MD5 checksum:   203706 99e563f18c123c3ca6508acdfd7f61f1
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_hppa.deb
        Size/MD5 checksum:   211750 41caee7138a21b342d9821e0d098298c
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_i386.deb
        Size/MD5 checksum:   191848 33af29a3f9e091dd6437fc3f3bfccab9
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_ia64.deb
        Size/MD5 checksum:   266176 0643774c9cdd1386f66ca090b303a369
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_mips.deb
        Size/MD5 checksum:   209536 5df3adcad12bccd7135a3fc9fb224af0
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_mipsel.deb
        Size/MD5 checksum:   209834 4961e97e904853264a1bd03fbb767abd
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_powerpc.deb
        Size/MD5 checksum:   199224 6ebb7bd7a1cb453650efee37cb742506
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_s390.deb
        Size/MD5 checksum:   209310 642204b4effb7d2e801147bdb5581ac1
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/p/polipo/polipo_1.0.4-1+lenny1_sparc.deb
        Size/MD5 checksum:   198238 1e9c3cb3e6818f3f72f5aa4ab247da65
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"5","type":"x","order":"1","pct":62.5,"resources":[]},{"id":"88","title":"Should be more technical","votes":"2","type":"x","order":"2","pct":25,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":12.5,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.