Summary
The remote host is missing an update to squid
announced via advisory DSA 019-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20019-1
Insight
WireX discovered a potential temporary file race condition in the way that squid sends out email messages notifying the administrator about updating the program. This could lead to arbitrary files to get overwritten. However the code would only be executed if running a very bleeding edge release of squid, running a server whose time is set some number of months in the past and squid is crashing. Read it as hardly to exploit. This version also containes more upstream bugfixes wrt. dots in hostnames and unproper HTML quoting.
We recommend you upgrade your squid package..
Severity
Classification
-
CVE CVE-2001-0142 -
CVSS Base Score: 1.2
AV:L/AC:H/Au:N/C:N/I:P/A:N
Related Vulnerabilities
- Debian Security Advisory DSA 2649-1 (lighttpd - fixed socket name in world-writable directory)
- Debian Security Advisory DSA 2606-1 (proftpd-dfsg - symlink race)
- Debian Security Advisory DSA 1420-1 (zabbix)
- Debian Security Advisory DSA 1725-1 (websvn)
- Debian Security Advisory DSA 2879-1 (libssh - security update)