Security World: [SECURITY] [DSA-2035-1] New apache2 packages fix several issues

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2035-1 security@debian.org
http://www.debian.org/security/ Stefan Fritsch
April 17, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : apache2
Vulnerability : multiple issues
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2010-0408 CVE-2010-0434

Two issues have been found in the Apache HTTPD web server:

CVE-2010-0408

mod_proxy_ajp would return the wrong status code if it encountered an
error, causing a backend server to be put into an error state until the
retry timeout expired. A remote attacker could send malicious requests
to trigger this issue, resulting in denial of service.

CVE-2010-0434

A flaw in the core subrequest process code was found, which could lead
to a daemon crash (segfault) or disclosure of sensitive information
if the headers of a subrequest were modified by modules such as
mod_headers.

For the stable distribution (lenny), these problems have been fixed in
version 2.2.9-10+lenny7.

For the testing distribution (squeeze) and the unstable distribution
(sid), these problems have been fixed in version 2.2.15-1.

This advisory also provides updated apache2-mpm-itk packages which
have been recompiled against the new apache2 packages.

We recommend that you upgrade your apache2 and apache2-mpm-itk packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny (stable)
- -----------------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

- From the apache2 source package:

Source archives:

http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9-10+lenny7.dsc
Size/MD5 checksum: 1682 58737d2f0024a178d40db6f9356e5b6a
http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9-10+lenny7.diff.gz
Size/MD5 checksum: 147059 f599c83adbced41a7339524c512ae0cd
http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9.orig.tar.gz
Size/MD5 checksum: 6396996 80d3754fc278338033296f0d41ef2c04

Architecture independent packages:

http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9-10+lenny7_all.deb
Size/MD5 checksum: 45366 9f02e6acd2828a7cfcb5c9e4866ab120
http://security.debian.org/pool/updates/main/a/apache2/apache2-doc_2.2.9-10+lenny7_all.deb
Size/MD5 checksum: 2060854 5b1f6debc65b7ca2ae8156b21f0d0597
http://security.debian.org/pool/updates/main/a/apache2/apache2-src_2.2.9-10+lenny7_all.deb
Size/MD5 checksum: 6737126 afec2194fa17efb6e4096c1019936cd0

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

- From the apache2-mpm-itk source package:

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b4_alpha.deb
Size/MD5 checksum: 198270 37511ff523c00dfd94686da9c4ed1ad7

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b3_amd64.deb
Size/MD5 checksum: 195222 9764e5a1bcdf1501381c5cb22d1101db

arm architecture (ARM)

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b3_arm.deb
Size/MD5 checksum: 161916 6d9216fb6195f975464391c366d5d6eb

armel architecture (ARM EABI)

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b3_armel.deb
Size/MD5 checksum: 162904 9035f96ad7ec223298f256129a5f4fba

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b3_hppa.deb
Size/MD5 checksum: 183304 306d679dc522570254dcaa81b3105e73

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b3_i386.deb
Size/MD5 checksum: 178986 b955efd13a0734596a0b936913d564b2

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b3_ia64.deb
Size/MD5 checksum: 247228 3a115bf303067a8c29d2ec127a7ccc56

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b3_mips.deb
Size/MD5 checksum: 171054 a118f468ac32c7d2388fd98b98e8fffe

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b3_mipsel.deb
Size/MD5 checksum: 169500 90ac7e587508c02e3a0aac3d29087f7f

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b3_powerpc.deb
Size/MD5 checksum: 195234 914bb47b1c30dcb494a713ee17125b69

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b3_s390.deb
Size/MD5 checksum: 197564 be5c1c16a345935ad5a8e1fc299301e5

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny2+b3_sparc.deb
Size/MD5 checksum: 177732 acce311a9354b32da0b6d7f8f0255f70

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLyiBtbxelr8HyTqQRAjP8AKCdtD1u05RO7pXTZw8mrWjaE7NFjACeP//g
0zf7/TYGXjja7ZB12WjUb+s=
=X1dt
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/E1O3F5i-00025C-3X@chopin.debian.org

Security World

Search This Blog

Saturday, April 17, 2010

[SECURITY] [DSA-2035-1] New apache2 packages fix several issues

No comments: