What is Squid Proxy Cache Security Update Advisory SQUID-2007:2

KEYWORDS: OpenServer 6.0.0 Multiple Vulnerabilities Vulnerability Squid fz534652 
 CVE-2007-6239 Squid version 2.6.STABLE17 denial of service MP3

RELEASE:   SCO OpenServer Release 6.0.0

PROBLEM:  CERT Advisory CVE-2007-6239 
           
          Due to incorrect bounds checking, Squid is vulnerable to a 
          denial of service attack during some cache update reply 
          processing. This problem allows any client trusted to use 
          the service to perform a denial of service attack on the 
          Squid service.

SOLUTION: SCO Security Advisory

          Subject:               OpenServer 6.0.0 Vulnerability in Squid
          Advisory number:       CVE-2007-6239
          Issue Date:            November 28th 2007
          Cross Reference:       fz534652

          This bug is fixed by squid version 2.6.STABLE17

          All Squid-2.X versions up to, and including 2.6.STABLE16
          are vulnerable. 

          Reference:

          http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6239

REQUIREMENTS: OpenServer 6 with Maintenance Pack 3

INSTALLATION: Download the updated version from:

              http://www.sco.com/support/update/download/release.php?rid=315

              or

              ftp://ftp.sco.com/pub/openserver6/600/other/squid-2.6.17Da

              and extract the tar archive of media images for
              Squid (squid-2.6.17Da-VOLS.tar) into an empty directory.
              For example:
                  # cd /u/tmp/squid
                  # tar xvf squid-2.6.17Da-VOLS.tar

              Using the SCO Software Manager (/etc/custom), select
              Software -> Install New -> From <your system>
              Select "Media Images" for the Media Device and "Continue"
              Enter the directory where the Squid media images were
              extracted (in above example, /u/tmp/squid) for the Image
              Directory and press "OK". 

          Disclaimer:

          SCO is not responsible for the misuse of any of the
          information we provide on this website and/or through our
          security advisories. Our advisories are a service to our
          customers intended to promote secure installation and use
          of SCO products.
