bugtraq - [USN-23-1] apache2 vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20041111215614.GA26032@box79162.elkhouse.de>
Date: Thu, 11 Nov 2004 22:56:14 +0100
From: Martin Pitt <martin.pitt@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: [USN-23-1] apache2 vulnerability

===========================================================
Ubuntu Security Notice USN-23-1		  November 11, 2004
apache2 vulnerability
CAN-2004-0942
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

apache2-mpm-perchild
apache2-mpm-prefork
apache2-mpm-threadpool
apache2-mpm-worker

The problem can be corrected by upgrading the affected package to
version 2.0.50-12ubuntu4.1.  In general, a standard system upgrade is
sufficient to effect the necessary changes.

Details follow:

Chintan Trivedi discovered a Denial of Service vulnerability in
apache2. The field length limit was not enforced for certain malicious
requests. This could allow a remote attacker who is able to send large
amounts of data to a server to cause HTTP server instances to consume
proportional amounts of memory, which can render the service
unavailable.

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.50-12ubuntu4.1.diff.gz
      Size/MD5:    97967 cf0c1c891580db78dcc5446a767ac000
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.50-12ubuntu4.1.dsc
      Size/MD5:     1151 0a7f762f4626fde4e303c1cc4d9ba78c
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.50.orig.tar.gz
      Size/MD5:  6321209 9d0767f8a1344229569fcd8272156f8b

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0.50-12ubuntu4.1_all.deb
      Size/MD5:  3178054 82b91224019b7e1ebcb04ce6dab1839d
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.50-12ubuntu4.1_all.deb
      Size/MD5:   163482 755fa2140e2cbc1242c56525614555a2
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.50-12ubuntu4.1_all.deb
      Size/MD5:   164232 e79331594b1b564c3fa7d71ff01a3db7

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.50-12ubuntu4.1_amd64.deb
      Size/MD5:   864366 b9d51742d0d08c0f1afd96ad2ae691da
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.50-12ubuntu4.1_amd64.deb
      Size/MD5:   230102 d0b900d7e94f54e102492328c58d1893
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.50-12ubuntu4.1_amd64.deb
      Size/MD5:   225242 fd5d08467e04612d7e0094502c9b6565
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-threadpool_2.0.50-12ubuntu4.1_amd64.deb
      Size/MD5:   228684 c40e8b7c350bc15339404a906a7901a0
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.50-12ubuntu4.1_amd64.deb
      Size/MD5:   229262 1cfd8eb69f072c2cfd2b4c2cca68814b
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.50-12ubuntu4.1_amd64.deb
      Size/MD5:    29710 cfcf4d17b8d836b58abdd6afc85913ec
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.50-12ubuntu4.1_amd64.deb
      Size/MD5:   275206 ccaea19446f99022bcd3d8c7006d861e
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.50-12ubuntu4.1_amd64.deb
      Size/MD5:   133148 0fa8b4ab41df7319e233ac142e08c938

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.50-12ubuntu4.1_i386.deb
      Size/MD5:   825680 823bf43c10f5afb125458c02e06bd422
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.50-12ubuntu4.1_i386.deb
      Size/MD5:   209084 f7114acd490b347bcc175f30b1d496da
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.50-12ubuntu4.1_i386.deb
      Size/MD5:   205306 8815b7c99177c33edfa94ba5c0359416
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-threadpool_2.0.50-12ubuntu4.1_i386.deb
      Size/MD5:   207946 193b3f6c0710dc80b8acf08b951bc2f6
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.50-12ubuntu4.1_i386.deb
      Size/MD5:   208388 7d11333a5ec1876f99030dd958c9a43f
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.50-12ubuntu4.1_i386.deb
      Size/MD5:    29706 af8f749040fca22310e315d310331ce1
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.50-12ubuntu4.1_i386.deb
      Size/MD5:   253176 9c4587c217ba98d6b63b50d18f5a7ba6
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.50-12ubuntu4.1_i386.deb
      Size/MD5:   123872 5367a153ef8c66a4307b1250b3321d7f

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.50-12ubuntu4.1_powerpc.deb
      Size/MD5:   903480 12c41213108120eabb9cafd2ab97af79
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.50-12ubuntu4.1_powerpc.deb
      Size/MD5:   222718 5054b3fc46baeea33ccb1c7677c49097
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.50-12ubuntu4.1_powerpc.deb
      Size/MD5:   217722 79d6763364edccb0571a9918e9e7f595
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-threadpool_2.0.50-12ubuntu4.1_powerpc.deb
      Size/MD5:   220892 01df3447f3668931d3ee7f3a055d1b88
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.50-12ubuntu4.1_powerpc.deb
      Size/MD5:   221500 62851f812cba3ee3df558cdcc3ab5d33
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.50-12ubuntu4.1_powerpc.deb
      Size/MD5:    29716 8148f425dac482351c32fbce31b37e8b
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.50-12ubuntu4.1_powerpc.deb
      Size/MD5:   268974 71585a0eee76b026e0623f526da43fc0
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.50-12ubuntu4.1_powerpc.deb
      Size/MD5:   130482 16e3a998f505e6a8dc0c8c48909c4886

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)