Security World: [SECURITY] [DSA 1834-2] New apache/apache2-mpm-itk fix regression

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1834-2 security@debian.org
http://www.debian.org/security/ Stefan Fritsch
July 31, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : apache2
Vulnerability : denial of service
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2009-1890 CVE-2009-1891

The previous update caused a regression for apache2 in Debian 4.0
"etch". Using mod_deflate together with mod_php could cause segfaults
when a client aborts a connection. This update corrects this flaw.
For reference the original advisory text is below.

A denial of service flaw was found in the Apache mod_proxy module when
it was used as a reverse proxy. A remote attacker could use this flaw
to force a proxy process to consume large amounts of CPU time. This
issue did not affect Debian 4.0 "etch". (CVE-2009-1890)

A denial of service flaw was found in the Apache mod_deflate module.
This module continued to compress large files until compression was
complete, even if the network connection that requested the content
was closed before compression completed. This would cause mod_deflate
to consume large amounts of CPU if mod_deflate was enabled for a large
file. A similar flaw related to HEAD requests for compressed content
was also fixed. (CVE-2009-1891)

The oldstable distribution (etch), this problem has been fixed in
version 2.2.3-4+etch10.

The other distributions stable (lenny), testing (squeeze) and
unstable (sid) were not affected by the regression.

This advisory also provides updated apache2-mpm-itk packages which
have been recompiled against the new apache2 packages.

Updated packages for apache2-mpm-itk for the s390 architecture are
not included yet. They will be released as soon as they become
available.

We recommend that you upgrade your apache2 (2.2.3-4+etch10), apache2-mpm-itk
(2.2.3-01-2+etch4) package.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.3-4+etch10.diff.gz
Size/MD5 checksum: 127383 f93c44605a130b89c93b967c6e6bb32f
http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01.orig.tar.gz
Size/MD5 checksum: 29071 63daaf8812777aacfd5a31ead4ff0061
http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4.diff.gz
Size/MD5 checksum: 12732 f46b409815f523fb15fc2b013bece3b2
http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.3-4+etch10.dsc
Size/MD5 checksum: 1070 4baefcb4c6ec1f2d146f1387a5240026
http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4.dsc
Size/MD5 checksum: 676 b385d6a3a328371323c79c7906deb5bf
http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.3.orig.tar.gz
Size/MD5 checksum: 6342475 f72ffb176e2dc7b322be16508c09f63c

Architecture independent packages:

http://security.debian.org/pool/updates/main/a/apache2/apache2-src_2.2.3-4+etch10_all.deb
Size/MD5 checksum: 6673900 95cf69a8148a93569f183e417753226d
http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.3-4+etch10_all.deb
Size/MD5 checksum: 41480 dc99f23beb96a0a743d3d61d6c8d941d
http://security.debian.org/pool/updates/main/a/apache2/apache2-doc_2.2.3-4+etch10_all.deb
Size/MD5 checksum: 2243464 1239e372d92afb5551cfa6018e509797
http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-perchild_2.2.3-4+etch10_all.deb
Size/MD5 checksum: 274332 5ac8887f0d4b5e46a2d6461a1c75234d

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch10_alpha.deb
Size/MD5 checksum: 345878 09b90c946e6bfab4df70096345b73753
http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch10_alpha.deb
Size/MD5 checksum: 445144 c578da017ebba196a95e148b22f45e0f
http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch10_alpha.deb
Size/MD5 checksum: 409542 7a2897d2effa66ce0e8125e81c12d98e
http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch10_alpha.deb
Size/MD5 checksum: 410448 f6b3abb4d3f7e58f5439969bacdcd693
http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_alpha.deb
Size/MD5 checksum: 185014 699e45fb31514a058a69fb6c6e7bc7ae
http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch10_alpha.deb
Size/MD5 checksum: 1043540 f438e482259956a7e0f110dc28ac868a
http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch10_alpha.deb
Size/MD5 checksum: 449444 f0b040f783a19ea83aa7fc195dfd5b95
http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch10_alpha.deb
Size/MD5 checksum: 450050 9fe6f4b3f9006c9932161272a78c6fdf

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch10_hppa.deb
Size/MD5 checksum: 439794 ae3ee116b4f6734d19e2608c986f20a7
http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch10_hppa.deb
Size/MD5 checksum: 410668 0332975eef0ca8914493434c81a3b57c
http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch10_hppa.deb
Size/MD5 checksum: 351926 aba7da336587d20e3472c42399a60cbb
http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch10_hppa.deb
Size/MD5 checksum: 443764 94b899d6e77c0a1138a1adca32e964d4
http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch10_hppa.deb
Size/MD5 checksum: 409798 87358d3a8d78ae38b43147ffc005dbea
http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch10_hppa.deb
Size/MD5 checksum: 1078344 5c5df848f29a6b94edd74aaa1938339d
http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch10_hppa.deb
Size/MD5 checksum: 443176 a3418d816ee5814bf8e4e1782ebf1a13
http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_hppa.deb
Size/MD5 checksum: 179290 76bada2a7c0b4ce41781da02bc1d6854

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch10_s390.deb
Size/MD5 checksum: 437110 aa86e0b23b46beeaaa5438336fe04552
http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch10_s390.deb
Size/MD5 checksum: 406788 d5e931d2fdf36c7fb983e7e1f710653c
http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch10_s390.deb
Size/MD5 checksum: 407450 932daa00b0a6d967b1af613ea0930034
http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch10_s390.deb
Size/MD5 checksum: 348416 70b8e219b4c86095065b11875ec83b01
http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch10_s390.deb
Size/MD5 checksum: 993986 0dd64eb40ee4a89fd3fbff4d1997d30e
http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch10_s390.deb
Size/MD5 checksum: 442014 ccb9c5a6ca257e10305cd3772b1d83ff
http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch10_s390.deb
Size/MD5 checksum: 443016 4b986bfae8d89f66e8482632d528a449

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch10_sparc.deb
Size/MD5 checksum: 422172 ffb5cc475c8c9773b588afee5cf2e516
http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch10_sparc.deb
Size/MD5 checksum: 959208 3122892629c49a09287803c4f0298281
http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch10_sparc.deb
Size/MD5 checksum: 409556 a32ab93bcc5458fa0a6d98634075c6e6
http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch10_sparc.deb
Size/MD5 checksum: 422568 8e9b179b70d757b411e76e5b7005ba6e
http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_sparc.deb
Size/MD5 checksum: 157826 bdc36b078bd4f6cb2a5ed6ea7714a74c
http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch10_sparc.deb
Size/MD5 checksum: 408632 a834c57ec1d4022e335f7438038ae042
http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch10_sparc.deb
Size/MD5 checksum: 343696 db40b0d4b164b8490009aa110621db9c
http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch10_sparc.deb
Size/MD5 checksum: 418790 6e51c4c6412d868e5e55808fd4f6865a

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkpxzD8ACgkQHYflSXNkfP+i6ACfT3zRAuBRH9iUBZsJoo2icICd
HX4AmgNjdFHPYwEW8wrj7f0Wec7E+Zci
=XHdI
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Thursday, July 30, 2009

[SECURITY] [DSA 1834-2] New apache/apache2-mpm-itk fix regression

No comments:

Post a Comment