what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Slackware Security Advisory - httpd Updates

Slackware Security Advisory - httpd Updates
Posted Feb 13, 2012
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New httpd packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues. The apr-util package has also been updated to the latest version.

tags | advisory
systems | linux, slackware
advisories | CVE-2011-3368, CVE-2011-3607, CVE-2011-4317, CVE-2012-0021, CVE-2012-0031, CVE-2012-0053
SHA-256 | d918adbd8e8a933420c61087ab85772332adaaf1a957177ead0deb868b6d1325
Download | Favorite | View

Slackware Security Advisory - httpd Updates

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  httpd (SSA:2012-041-01)

New httpd packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1,
13.37, and -current to fix security issues.  The apr-util package has also been
updated to the latest version.


Here are the details from the Slackware 13.37 ChangeLog:
+--------------------------+
patches/packages/apr-util-1.4.1-i486-1_slack13.37.txz:  Upgraded.
  Version bump for httpd upgrade.
patches/packages/httpd-2.2.22-i486-1_slack13.37.txz:  Upgraded.
  *) SECURITY: CVE-2011-3368 (cve.mitre.org)
     Reject requests where the request-URI does not match the HTTP
     specification, preventing unexpected expansion of target URLs in
     some reverse proxy configurations.  [Joe Orton]
  *) SECURITY: CVE-2011-3607 (cve.mitre.org)
     Fix integer overflow in ap_pregsub() which, when the mod_setenvif module
     is enabled, could allow local users to gain privileges via a .htaccess
     file. [Stefan Fritsch, Greg Ames]
  *) SECURITY: CVE-2011-4317 (cve.mitre.org)
     Resolve additional cases of URL rewriting with ProxyPassMatch or
     RewriteRule, where particular request-URIs could result in undesired
     backend network exposure in some configurations.
     [Joe Orton]
  *) SECURITY: CVE-2012-0021 (cve.mitre.org)
     mod_log_config: Fix segfault (crash) when the '%{cookiename}C' log format
     string is in use and a client sends a nameless, valueless cookie, causing
     a denial of service. The issue existed since version 2.2.17. PR 52256.
     [Rainer Canavan <rainer-apache 7val com>]
  *) SECURITY: CVE-2012-0031 (cve.mitre.org)
     Fix scoreboard issue which could allow an unprivileged child process
     could cause the parent to crash at shutdown rather than terminate
     cleanly.  [Joe Orton]
  *) SECURITY: CVE-2012-0053 (cve.mitre.org)
     Fix an issue in error responses that could expose "httpOnly" cookies
     when no custom ErrorDocument is specified for status code 400.
     [Eric Covener]
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3368
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3607
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4317
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0021
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0031
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0053
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(https://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on https://slackware.com for
additional mirror sites near you.

Updated packages for Slackware 12.0:
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/apr-util-1.4.1-i486-1_slack12.0.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/httpd-2.2.22-i486-1_slack12.0.tgz

Updated packages for Slackware 12.1:
ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/apr-util-1.4.1-i486-1_slack12.1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/httpd-2.2.22-i486-1_slack12.1.tgz

Updated packages for Slackware 12.2:
ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/apr-util-1.4.1-i486-1_slack12.2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/httpd-2.2.22-i486-1_slack12.2.tgz

Updated packages for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/apr-util-1.4.1-i486-1_slack13.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/httpd-2.2.22-i486-1_slack13.0.txz

Updated packages for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/apr-util-1.4.1-x86_64-1_slack13.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/httpd-2.2.22-x86_64-1_slack13.0.txz

Updated packages for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/apr-util-1.4.1-i486-1_slack13.1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/httpd-2.2.22-i486-1_slack13.1.txz

Updated packages for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/apr-util-1.4.1-x86_64-1_slack13.1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/httpd-2.2.22-x86_64-1_slack13.1.txz

Updated packages for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/apr-util-1.4.1-i486-1_slack13.37.txz
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/httpd-2.2.22-i486-1_slack13.37.txz

Updated packages for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/apr-util-1.4.1-x86_64-1_slack13.37.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/httpd-2.2.22-x86_64-1_slack13.37.txz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/apr-util-1.4.1-i486-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/httpd-2.2.22-i486-1.txz

Updated packages for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/apr-util-1.4.1-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/httpd-2.2.22-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 12.0 packages:
3143affee7e89d16a2f5b4f58f1f2c9d  apr-util-1.4.1-i486-1_slack12.0.tgz
86c2b71a544c9533794951f718bd907b  httpd-2.2.22-i486-1_slack12.0.tgz

Slackware 12.1 packages:
aab31157fa672bb2bc11851b486c9d5c  apr-util-1.4.1-i486-1_slack12.1.tgz
1362ef9a9b2d355e1cf9b5c7e0ae0607  httpd-2.2.22-i486-1_slack12.1.tgz

Slackware 12.2 packages:
f30f1f0a949f321b6aefb99a703eca3f  apr-util-1.4.1-i486-1_slack12.2.tgz
18fd6ddd6e6bbf4a7222ade821ec1aa1  httpd-2.2.22-i486-1_slack12.2.tgz

Slackware 13.0 packages:
d3600fef7f1cabb62554417567fb55ab  apr-util-1.4.1-i486-1_slack13.0.txz
0456c808efb92da333942ff939746d77  httpd-2.2.22-i486-1_slack13.0.txz

Slackware x86_64 13.0 packages:
d15c2e0a4aa074bbadfa50099da482b2  apr-util-1.4.1-x86_64-1_slack13.0.txz
1b72685b2519bbf167973d88dce562e1  httpd-2.2.22-x86_64-1_slack13.0.txz

Slackware 13.1 packages:
9c7c2bb99c99f3a6275f0dc9636ce38c  apr-util-1.4.1-i486-1_slack13.1.txz
49a5e4a73be2328d80cca186efe2f6f7  httpd-2.2.22-i486-1_slack13.1.txz

Slackware x86_64 13.1 packages:
4f9dcb6495c04d3094cc68050440505b  apr-util-1.4.1-x86_64-1_slack13.1.txz
1f378f8a4d990d7298e0155b22cfcf19  httpd-2.2.22-x86_64-1_slack13.1.txz

Slackware 13.37 packages:
7feb382700511d72737c5a31e91ee56e  apr-util-1.4.1-i486-1_slack13.37.txz
783de593b5827c8601e2b486cf98397f  httpd-2.2.22-i486-1_slack13.37.txz

Slackware x86_64 13.37 packages:
1bd4b3df67a0449f3015e82e47cd808d  apr-util-1.4.1-x86_64-1_slack13.37.txz
8999903e736cbb29c055ea2bf66cfed1  httpd-2.2.22-x86_64-1_slack13.37.txz

Slackware -current packages:
e709c8056cede91c35fd354ad5b654df  l/apr-util-1.4.1-i486-1.txz
97c295a42d4678537c62d6ce54d3e1fa  n/httpd-2.2.22-i486-1.txz

Slackware x86_64 -current packages:
55fdf36b05ff7e82aa9a015289290424  l/apr-util-1.4.1-x86_64-1.txz
09daa138b81fbf877596e4abc2a01bb6  n/httpd-2.2.22-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the packages as root:
# upgradepkg apr-util-1.4.1-i486-1_slack13.37.txz httpd-2.2.22-i486-1_slack13.37.txz

Then, restart the httpd daemon.


+-----+

Slackware Linux Security Team
https://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk81VdkACgkQakRjwEAQIjOGhgCfWdrAq0pHF50KIH1oTMM8nxyv
1p0AniI9T9MxtNtJtXuLAhBS4429MOa9
=NH0B
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

November 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    30 Files
  • 2
    Nov 2nd
    0 Files
  • 3
    Nov 3rd
    0 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    44 Files
  • 6
    Nov 6th
    18 Files
  • 7
    Nov 7th
    9 Files
  • 8
    Nov 8th
    8 Files
  • 9
    Nov 9th
    3 Files
  • 10
    Nov 10th
    0 Files
  • 11
    Nov 11th
    14 Files
  • 12
    Nov 12th
    20 Files
  • 13
    Nov 13th
    63 Files
  • 14
    Nov 14th
    18 Files
  • 15
    Nov 15th
    8 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    18 Files
  • 19
    Nov 19th
    7 Files
  • 20
    Nov 20th
    13 Files
  • 21
    Nov 21st
    6 Files
  • 22
    Nov 22nd
    48 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    60 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close