[SECURITY] [DSA-132-1] apache-ssl chunk handling vulnerability

Debian Security Advisory DSA-132-1 [email protected]
http://www.debian.org/security/ Wichert Akkerman
June 19, 2002

Package : apache-ssl
Problem type : remote DoS / exploit
Debian-specific: no
CVE name : CAN-2002-0392
CERT advisory : VU#944335

Mark Litchfield found a denial of service attack in the Apache
web-server. While investigating the problem the Apache Software
Foundation discovered that the code for handling invalid requests which
use chunked encoding also might allow arbitrary code execution on 64 bit
architectures.

This has been fixed in version 1.3.9.13-4.1 of the Debian apache-ssl
package and we recommand that you upgrade your apache-ssl package
immediately.

An update for the soon to be released Debian GNU/Linux 3.0/woody
distribution is not available at the moment.

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

Debian GNU/Linux 2.2 alias potato

Potato was released for alpha, arm, i386, m68k, powerpc and sparc.

Source archives:
http://security.debian.org/dists/stable/updates/main/source/apache-ssl_1.3.9.13-4.1.diff.gz
MD5 checksum: 8ab934c0a178cfcef6fab8ec8439a8b6
http://security.debian.org/dists/stable/updates/main/source/apache-ssl_1.3.9.13-4.1.dsc
MD5 checksum: aa8b107a770a9ee133135751340e95d7
http://security.debian.org/dists/stable/updates/main/source/apache-ssl_1.3.9.13.orig.tar.gz
MD5 checksum: e28b3b656449a5a2f9080286ae3d743e

Alpha architecture:
http://security.debian.org/dists/stable/updates/main/binary-alpha/apache-ssl_1.3.9.13-4.1_alpha.deb
MD5 checksum: 66766a2077879878e08d0546b39afa1e

ARM architecture:
http://security.debian.org/dists/stable/updates/main/binary-arm/apache-ssl_1.3.9.13-4.1_arm.deb
MD5 checksum: d8831766486bc4554a4471480b0456e4

Intel IA-32 architecture:
http://security.debian.org/dists/stable/updates/main/binary-i386/apache-ssl_1.3.9.13-4.1_i386.deb
MD5 checksum: 906bb15e2e7b89e6025cb2589435d585

Motorola 680x0 architecture:
http://security.debian.org/dists/stable/updates/main/binary-m68k/apache-ssl_1.3.9.13-4.1_m68k.deb
MD5 checksum: 737f885f049d825e9c61c4edcf505afc

PowerPC architecture:
http://security.debian.org/dists/stable/updates/main/binary-powerpc/apache-ssl_1.3.9.13-4.1_powerpc.deb
MD5 checksum: 45ea56ed463d54e19626091bbbae2d27

Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/main/binary-sparc/apache-ssl_1.3.9.13-4.1_sparc.deb
MD5 checksum: 5185e05f5ca1a6f5aa7a4b7e25c80438

These packages will be moved into the stable distribution on its next
revision.

apt-get: deb http://security.debian.org/ stable/updates main
dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]