Date: Tue, 4 Aug 2009 19:48:13 +0200 From: Nico Golde <oss-security+ml@...lde.de> To: oss-security@...ts.openwall.com Subject: Re: squid DoS in external auth header parser Hi, * Vincent Danen <vdanen@...hat.com> [2009-08-04 17:20]: > * [2009-08-04 12:13:29 +0200] Nico Golde wrote: [...] > >CVE-2009-2622 > >CVE-2009-2621 > > Are you sure? > > According to MITRE's descriptions, CVE-2009-2621 deals with a lack of > enforcing "buffer limites and related bound checks", and CVE-2009-2622 > deals with malformed requests. When I was looking, it didn't seem like > either of these were the issue noted in the Debian bug. Bug #2704 on > the squid site is still UNCONFIRMED with no additional comments made to > it, so I don't think this is fixed in the latest upstream release (and > wouldn't fall under one of these CVE's). > > I don't think a CVE has been assigned to this issue, and I don't think > it has been fixed. Oergs sorry, yes you are right. I mixed up the issues here. Cheers Nico -- Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0xA0A0AAAA For security reasons, all text in this mail is double-rot13 encrypted. Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.