| |||||||||||||
Slackware alert SSA:2005-310-04 (apache)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] apache (SSA:2005-310-04) New apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix potential security issues: * If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks. * Added TraceEnable [on|off|extended] per-server directive to alter the behavior of the TRACE method. It's hard to say how much real-world impact these have, as there's no more information about that in the announcement. The original Apache announement can be read here: http://www.apache.org/dist/httpd/Announcement1.3.html Note that if you use mod_ssl, you will also need a new mod_ssl package. These have been provided for the same releases of Slackware. Here are the details from the Slackware 10.2 ChangeLog: +--------------------------+ patches/packages/apache-1.3.34-i486-1.tgz: Upgraded to apache-1.3.34. Fixes this minor security bug: "If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks." (* Security fix *) patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz: Upgraded to mod_ssl-2.8.25-1.3.34. +--------------------------+ Where to find the new packages: +-----------------------------+ Updated packages for Slackware 8.1: ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patch... ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patch... Updated packages for Slackware 9.0: ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patch... ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patch... Updated packages for Slackware 9.1: ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patch... ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patch... Updated packages for Slackware 10.0: ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patc... ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patc... Updated packages for Slackware 10.1: ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patc... ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patc... Updated packages for Slackware 10.2: ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patc... ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patc... Updated packages for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/s... ftp://ftp.slackware.com/pub/slackware/slackware-current/s... MD5 signatures: +-------------+ Slackware 8.1 packages: 5f49a812d8b9456af9e1843776aad2ea apache-1.3.34-i386-1.tgz 31916dd7d162b10d4e2b200471b90dc9 mod_ssl-2.8.25_1.3.34-i386-1.tgz Slackware 9.0 packages: 6867b391a99abe9804695e384bb2fc9f apache-1.3.34-i386-1.tgz 60ef5ab93eff3438688c2aeaefc6b2b9 mod_ssl-2.8.25_1.3.34-i386-1.tgz Slackware 9.1 packages: d63354a6b9a54739dcb14d1c6c2e45ef apache-1.3.34-i486-1.tgz 037056e0241a43d5615fc7358198f56e mod_ssl-2.8.25_1.3.34-i486-1.tgz Slackware 10.0 packages: ddd47c73ff5ed1fef564ad76907dd8ad apache-1.3.34-i486-1.tgz b95bcd1a58011674a725f6cba271a1d1 mod_ssl-2.8.25_1.3.34-i486-1.tgz Slackware 10.1 packages: bce588b7116d9f27b84bd831730e37e8 apache-1.3.34-i486-1.tgz dc375cdb6c5f4af75cefb4b1a593caf8 mod_ssl-2.8.25_1.3.34-i486-1.tgz Slackware 10.2 packages: 2409be9e6daa5046a2f03fa127028903 apache-1.3.34-i486-1.tgz d771b65a5b384448f3899d4e4aa686b8 mod_ssl-2.8.25_1.3.34-i486-1.tgz Slackware -current packages: 2409be9e6daa5046a2f03fa127028903 apache-1.3.34-i486-1.tgz d771b65a5b384448f3899d4e4aa686b8 mod_ssl-2.8.25_1.3.34-i486-1.tgz Installation instructions: +------------------------+ First, stop apache: # apachectl stop Then, upgrade the apache package: # upgradepkg apache-1.3.34-i486-1.tgz If you use mod_ssl, you'll also need to upgrade that package. The upgrade should save the important config files for mod_ssl, nevertheless it's a good idea to backup any keys/certificates you wish to save for mod_ssl (in /etc/apache/ssl.*), then upgrade mod_ssl: # upgradepkg mod_ssl-2.8.25_1.3.34-i486-1.tgz If necessary, restore any mod_ssl config files. Finally, restart apache: # apachectl start Or, if you use mod_ssl: # apachectl startssl +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. | +------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.7 (GNU/Linux) iD8DBQFDbmq9akRjwEAQIjMRAsyIAJ9LEBdI+uNh6+T0LecbyHuZP1SQeQCeNxKW IOJeoc/tdJ/cM0h+xu7J0k8= =w360 -----END PGP SIGNATURE----- (Log in to post comments)
|
|||||||||||||