ports/125076: [Maintainer] [security] www/squid30: update to 3.0.STABLE7, fix a DoS vulnerability in SNMP

[Thomas-Martin Seck]

>Number:         125076
>Category:       ports
>Synopsis:       [Maintainer] [security] www/squid30: update to 3.0.STABLE7, fix a DoS vulnerability in SNMP
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          maintainer-update
>Submitter-Id:   current-users
>Arrival-Date:   Sat Jun 28 12:50:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Thomas-Martin Seck
>Release:        FreeBSD 7.0-STABLE i386
>Organization:
a private site in Germany
>Environment:
FreeBSD ports collection as of June 28, 2008.

	
>Description:
- Update to Squid 3.0.STABLE7.
- Fix a DoS vulnerability in the SNMP query processing code.
  This vulnerability is the same as described in vid
  65e99f52-1c5f-11d9-bc4a-000c41e2cdad and I updated the VuXML entry
  accordingly, see patch below.
  SNMP is enabled by default in Squid-3 and in the FreeBSD port but must
  be explicitly activated by setting 'snmp_port' to a nonzero value in
  squid.conf.
  The reason only Squid-3 is affected is that the fix for the original
  issue was not backported from the Squid-2 tree to the Squid-3 tree back
  then.
	
>How-To-Repeat:
	
>Fix:
Apply this patch to security/vuxml/vuln.xml:

--- vuln.xml.orig	2008-06-28 14:08:45.000000000 +0200
+++ vuln.xml	2008-06-28 14:44:02.000000000 +0200
@@ -33860,6 +33860,7 @@
       <package>
 	<name>squid</name>
 	<range><lt>2.5.7</lt></range>
+	<range><ge>3.0.0</ge><lt>3.0.7</lt></range>
       </package>
     </affects>
     <description>
@@ -33873,16 +33874,22 @@
 	  explicitly enabled via "make config". As a workaround,
 	  SNMP can be disabled by defining "snmp_port 0" in
 	  squid.conf.</p>
+  	<p>Squid security advisory SQUID-2008:1 explains that Squid-3 versions
+	  up to and including Squid-3.0.STABLE6 are affected by this error,
+	  too.</p>
       </body>
     </description>
     <references>
       <cvename>CVE-2004-0918</cvename>
       <url>http://www.idefense.com/application/poi/display?id=152&type=vulnerabilities</url>
       <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump</url>
+      <url>http://www.squid-cache.org/Advisories/SQUID-2004_3.txt</url>
+      <url>http://www.squid-cache.org/Advisories/SQUID-2008_1.txt</url>
     </references>
     <dates>
       <discovery>2004-09-29</discovery>
       <entry>2004-10-12</entry>
+      <modified>2008-06-28</modified>
     </dates>
   </vuln>
 

Apply this patch to www/squid30:

Index: Makefile
===================================================================
--- Makefile	(.../www/squid30)	(revision 1413)
+++ Makefile	(.../local/squid30)	(revision 1413)
@@ -62,7 +62,7 @@
 #     requests.
 
 PORTNAME=	squid
-PORTVERSION=	3.0.6
+PORTVERSION=	3.0.7
 CATEGORIES=	www
 MASTER_SITES=	ftp://ftp.squid-cache.org/pub/%SUBDIR%/ \
 		ftp://mirrors.24-7-solutions.net/pub/squid/%SUBDIR%/ \
@@ -81,7 +81,7 @@
 		http://www1.jp.squid-cache.org/Versions/v3/3.0/ \
 		http://www2.tw.squid-cache.org/Versions/v3/3.0/
 MASTER_SITE_SUBDIR=	squid-3/STABLE
-DISTNAME=	squid-3.0.STABLE6
+DISTNAME=	squid-3.0.STABLE7
 DIST_SUBDIR=	squid3.0
 
 PATCH_SITES=	http://www.squid-cache.org/%SUBDIR%/ \
Index: distinfo
===================================================================
--- distinfo	(.../www/squid30)	(revision 1413)
+++ distinfo	(.../local/squid30)	(revision 1413)
@@ -1,3 +1,3 @@
-MD5 (squid3.0/squid-3.0.STABLE6.tar.bz2) = 231323a73346041cec825e785960e348
-SHA256 (squid3.0/squid-3.0.STABLE6.tar.bz2) = b01879f3d342bc031b9e92d006e50ae4d6cfeb918cda241c1f2e740becf1a720
-SIZE (squid3.0/squid-3.0.STABLE6.tar.bz2) = 1770652
+MD5 (squid3.0/squid-3.0.STABLE7.tar.bz2) = fa0fc5a3ce226099975b34c1cd2a3f95
+SHA256 (squid3.0/squid-3.0.STABLE7.tar.bz2) = 991d36bc25ffe361c9bdac9728035560a41b8fe8f33402f7e91ebbab4449eb02
+SIZE (squid3.0/squid-3.0.STABLE7.tar.bz2) = 1770797
 
	


>Release-Note:
>Audit-Trail:
>Unformatted: