From: secure@conectiva.com.br
To: conectiva-updates@papaleguas.conectiva.com.br, lwn@lwn.net,
bugtraq@securityfocus.com, security-alerts@linuxsecurity.com
Subject: [CLA-2002:498] Conectiva Linux Security Announcement - apache
Date: Wed, 19 Jun 2002 17:35:38 -0300
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : apache
SUMMARY : Chunk transfer encoding vulnerability
DATE : 2002-06-19 17:30:00
ID : CLA-2002:498
RELEVANT
RELEASES : 6.0, 7.0, 8
- -------------------------------------------------------------------------
DESCRIPTION
Apache[1] is the most popular webserver in use today.
Mark Litchfield reported to the apache team a denial of service
vulnerability in the apache webserver. Further investigation done by
the Apache authors[3] revealed that this could also lead to remote
code execution on 64bit unix platforms and on windows systems.
The vulnerability is in the code that deals with chunk transfer
encoding requests. Upon receiving a specially crafter request, the
child process servicing that request will at least segfault. This
does not shut down the entire server, just that child process, but
this could be used as a denial of service attack if done repeatedly.
On systems where this could be abused to execute arbitrary code, the
attacker's code woule be executed with the privileges of the child
process, tipically "nobody" or "www" (low privilege user).
After being informed about this vulnerability, the Apache team worked
to produce a new version, 1.3.26, which addresses this problem and is
being made available in this update.
Note: apache 2.0.36 and below are also vulnerable to this problem,
but are not shipped in any Conectiva Linux distribution.
SOLUTION
All apache users should upgrade the packages immediately.
IMPORTANT: it is necessary to manually restart the httpd server after
upgrading the packages. In order to do this, execute the following as
root:
service httpd stop
(wait a few seconds and check with "ps ax|grep httpd" if there are
any httpd processes running. On a busy webserver this could take a
little longer)
service httpd start
REFERENCES
1. http://httpd.apache.org
2. http://www.cert.org/advisories/CA-2002-17.html
3. http://httpd.apache.org/info/security_bulletin_20020617.txt
DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/apache-1.3.26-1U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-1.3.26-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-devel-1.3.26-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-doc-1.3.26-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/apache-1.3.26-1U70_4cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-1.3.26-1U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-devel-1.3.26-1U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-doc-1.3.26-1U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/apache-1.3.26-1U8_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-1.3.26-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-devel-1.3.26-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-doc-1.3.26-1U8_1cl.i386.rpm
ADDITIONAL INSTRUCTIONS
Users of Conectiva Linux version 6.0 or higher may use apt to perform
upgrades of RPM packages:
- add the following line to /etc/apt/sources.list if it is not there yet
(you may also use linuxconf to do this):
rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates
(replace 6.0 with the correct version number if you are not running CL6.0)
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE9EOsZ42jd0JmAcZARAjY7AJ4uxNWVks1/7/t8Xijk4b/85NIxPwCgkuDs
paDG/J6IEYp8kE6CbMBldiE=
=Wj8H
-----END PGP SIGNATURE-----
