Re: [SECURITY] [DSA 751-1] New squid packages fix IP spoofing vulnerability
- To: debian-security@lists.debian.org
- Subject: Re: [SECURITY] [DSA 751-1] New squid packages fix IP spoofing vulnerability
- From: Florian Weimer <fw@deneb.enyo.de>
- Date: Mon, 11 Jul 2005 17:23:26 +0200
- Message-id: <[🔎] 87wtnxjrip.fsf@deneb.enyo.de>
- In-reply-to: <m1Drzrd-000ojEC@finlandia.Infodrom.North.DE> (Martin Schulze's message of "Mon, 11 Jul 2005 17:06:33 +0200 (CEST)")
- References: <m1Drzrd-000ojEC@finlandia.Infodrom.North.DE>
* Martin Schulze:
> The upstream developers have discovered a bug in the DNS lookup code
> of Squid, the popular WWW proxy cache. When the DNS client UDP port
> (assigned by the operating system at startup) is unfiltered and the
> network is not protected from IP spoofing, malicious users can spoof
> DNS lookups which could result in users being redirected to arbitrary
> web sites.
What is the exact cause of the problem? Non-random message IDs?
Reply to: