Debian alert: apache-ssl chunk handling vulnerability

-----BEGIN PGP SIGNED MESSAGE-----

- ------------------------------------------------------------------------
Debian Security Advisory DSA-132-1                   security@debian.org
http://www.debian.org/security/                         Wichert Akkerman
June 19, 2002
- ------------------------------------------------------------------------


Package        : apache-ssl
Problem type   : remote DoS / exploit
Debian-specific: no
CVE name       : CAN-2002-0392
CERT advisory  : VU#944335

Mark Litchfield found a denial of service attack in the Apache
web-server. While investigating the problem the Apache Software
Foundation discovered that the code for handling invalid requests which
use chunked encoding also might allow arbitrary code execution on 64 bit
architectures.

This has been fixed in version 1.3.9.13-4.1 of the Debian apache-ssl
package and we recommand that you upgrade your apache-ssl package
immediately.

An update for the soon to be released Debian GNU/Linux 3.0/woody
distribution is not available at the moment.


wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.


Debian GNU/Linux 2.2 alias potato
- ---------------------------------

  Potato was released for alpha, arm, i386, m68k, powerpc and sparc.


  Source archives:
    http://security.debian.org/dists/stable/updates/main/source/apache-ssl_1.3.9.13-4.1.diff.gz
      MD5 checksum: 8ab934c0a178cfcef6fab8ec8439a8b6
    http://security.debian.org/dists/stable/updates/main/source/apache-ssl_1.3.9.13-4.1.dsc
      MD5 checksum: aa8b107a770a9ee133135751340e95d7
    http://security.debian.org/dists/stable/updates/main/source/apache-ssl_1.3.9.13.orig.tar.gz
      MD5 checksum: e28b3b656449a5a2f9080286ae3d743e

  Alpha architecture:
    http://security.debian.org/dists/stable/updates/main/binary-alpha/apache-ssl_1.3.9.13-4.1_alpha.deb
      MD5 checksum: 66766a2077879878e08d0546b39afa1e

  ARM architecture:
    http://security.debian.org/dists/stable/updates/main/binary-arm/apache-ssl_1.3.9.13-4.1_arm.deb
      MD5 checksum: d8831766486bc4554a4471480b0456e4

  Intel IA-32 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-i386/apache-ssl_1.3.9.13-4.1_i386.deb
      MD5 checksum: 906bb15e2e7b89e6025cb2589435d585

  Motorola 680x0 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-m68k/apache-ssl_1.3.9.13-4.1_m68k.deb
      MD5 checksum: 737f885f049d825e9c61c4edcf505afc

  PowerPC architecture:
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/apache-ssl_1.3.9.13-4.1_powerpc.deb
      MD5 checksum: 45ea56ed463d54e19626091bbbae2d27

  Sun Sparc architecture:
    http://security.debian.org/dists/stable/updates/main/binary-sparc/apache-ssl_1.3.9.13-4.1_sparc.deb
      MD5 checksum: 5185e05f5ca1a6f5aa7a4b7e25c80438


  These packages will be moved into the stable distribution on its next
  revision.

- -- 
- ----------------------------------------------------------------------------
apt-get: deb http://security.debian.org/ stable/updates main
dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQB1AwUBPRCCmqjZR/ntlUftAQF7VQL/UZaZOzBmIAL1pbwsV0VKmNa0BD6ThJYU
rBPIkPGQ9rOR9SCk4yc49dVx1Tgm7Yjl4cGSGg+WG1CXsDmpUqzo5m7qnAJexCLp
wxlEY1QL/IoaY9WRbrWV66UnMAPVwQiO
=flUP
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to debian-security-announce-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org