漏洞类别：Amazon Linux漏洞等级： 
漏洞信息
A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code. (CVE-2016-4051 )
It was found that the fix for CVE-2016-4051 did not properly prevent the stack overflow in the munge_other_line() function. A remote attacker could send specially crafted data to the Squid proxy, which would exploit the cachemgr CGI utility, possibly triggering execution of arbitrary code. (CVE-2016-5408 )
漏洞危害
Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.
解决方案
Please refer to Amazon advisory ALAS-2016-735 for affected packages and patching details, or update with your package manager.
Patch:
Following are links for downloading patches to fix the vulnerabilities:
ALAS-2016-735: Amazon Linux (squid (3.1.23-16.22.amzn1) on i686)
ALAS-2016-735: Amazon Linux (squid (3.1.23-16.22.amzn1) on x86_64)
ALAS-2016-735: Amazon Linux (squid (3.1.23-16.22.amzn1) on src)
0day
文章评论