apache

2005-11-06T13:03:35
ID SSA-2005-310-04
Type slackware
Reporter Slackware Linux Project
Modified 2005-11-06T13:03:35

Description

New apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix potential security issues:

  * If a request contains both Transfer-Encoding and Content-Length
    headers, remove the Content-Length, mitigating some HTTP Request
    Splitting/Spoofing attacks.

  * Added TraceEnable [on|off|extended] per-server directive to alter
    the behavior of the TRACE method.

It's hard to say how much real-world impact these have, as there's no more information about that in the announcement. The original Apache announement can be read here:

http://www.apache.org/dist/httpd/Announcement1.3.html

Note that if you use mod_ssl, you will also need a new mod_ssl package. These have been provided for the same releases of Slackware.

Here are the details from the Slackware 10.2 ChangeLog:

patches/packages/apache-1.3.34-i486-1.tgz: Upgraded to apache-1.3.34. Fixes this minor security bug: "If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks." ( Security fix ) patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz: Upgraded to mod_ssl-2.8.25-1.3.34.

Where to find the new packages:

Updated packages for Slackware 8.1: ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/apache-1.3.34-i386-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/mod_ssl-2.8.25_1.3.34-i386-1.tgz

Updated packages for Slackware 9.0: ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/apache-1.3.34-i386-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/mod_ssl-2.8.25_1.3.34-i386-1.tgz

Updated packages for Slackware 9.1: ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/apache-1.3.34-i486-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware 10.0: ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/apache-1.3.34-i486-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware 10.1: ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/apache-1.3.34-i486-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware 10.2: ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/apache-1.3.34-i486-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/apache-1.3.34-i486-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/mod_ssl-2.8.25_1.3.34-i486-1.tgz

MD5 signatures:

Slackware 8.1 packages: 5f49a812d8b9456af9e1843776aad2ea apache-1.3.34-i386-1.tgz 31916dd7d162b10d4e2b200471b90dc9 mod_ssl-2.8.25_1.3.34-i386-1.tgz

Slackware 9.0 packages: 6867b391a99abe9804695e384bb2fc9f apache-1.3.34-i386-1.tgz 60ef5ab93eff3438688c2aeaefc6b2b9 mod_ssl-2.8.25_1.3.34-i386-1.tgz

Slackware 9.1 packages: d63354a6b9a54739dcb14d1c6c2e45ef apache-1.3.34-i486-1.tgz 037056e0241a43d5615fc7358198f56e mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware 10.0 packages: ddd47c73ff5ed1fef564ad76907dd8ad apache-1.3.34-i486-1.tgz b95bcd1a58011674a725f6cba271a1d1 mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware 10.1 packages: bce588b7116d9f27b84bd831730e37e8 apache-1.3.34-i486-1.tgz dc375cdb6c5f4af75cefb4b1a593caf8 mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware 10.2 packages: 2409be9e6daa5046a2f03fa127028903 apache-1.3.34-i486-1.tgz d771b65a5b384448f3899d4e4aa686b8 mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware -current packages: 2409be9e6daa5046a2f03fa127028903 apache-1.3.34-i486-1.tgz d771b65a5b384448f3899d4e4aa686b8 mod_ssl-2.8.25_1.3.34-i486-1.tgz

Installation instructions:

First, stop apache:

> apachectl stop

Then, upgrade the apache package:

> upgradepkg apache-1.3.34-i486-1.tgz

If you use mod_ssl, you'll also need to upgrade that package. The upgrade should save the important config files for mod_ssl, nevertheless it's a good idea to backup any keys/certificates you wish to save for mod_ssl (in /etc/apache/ssl.*), then upgrade mod_ssl:

> upgradepkg mod_ssl-2.8.25_1.3.34-i486-1.tgz

If necessary, restore any mod_ssl config files.

Finally, restart apache:

> apachectl start

Or, if you use mod_ssl:

> apachectl startssl