The squid (v2) package had all of the hardening options enabled (see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542723) due to squid receiving and parsing network input and the number of and severity of prior security issues; however, with the transition to squid3 some of these options were lost by falling back to the default compiler settings.
STEPS TO REPRODUCE:
1) install the hardening-includes package
2) run '/usr/bin/hardening-check /usr/sbin/squid3'
If all the hardening options were enabled at compile time, the output and return code should be:
$ hardening-check /usr/sbin/squid3
/usr/sbin/squid3:
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: yes
$ echo $?
0
However, with the current squid3 version in precise(3.1.19-1ubuntu2) , the output and return code are like so:
$ /usr/bin/hardening-check /usr/sbin/squid3
/usr/sbin/squid3:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
$ echo $?
1
You can also use the test-built-binaries.py script from the lp:qa-regression-testing testsuite, with python-nose to run just the squid portion, like so:
$ nosetests test-built-binaries.py:BuiltBinariesTest.test_squid -v
Testing squid ... ok
----------------------------------------------------------------------
Ran 1 test in 3.699s
OK
For more details on the hardening options, please see http://
Attached is a debdiff for precise-proposed SRU that addresses the issue as well as fixes the file descriptor limit in bug 986159. I've built and confirmed both issues locally, as well as performed a modicum of testing to verify that squid3 still functions as expected.
Thanks.