===========================================================
Ubuntu Security Notice USN-160-2 September 07, 2005
apache vulnerability
CAN-2005-2088
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
The following packages are affected:
apache
apache-perl
apache-ssl
The problem can be corrected by upgrading the affected package to
version 1.3.31-6ubuntu0.8 (for Ubuntu 4.10), or 1.3.33-4ubuntu1 (for
Ubuntu 5.04). In general, a standard system upgrade is sufficient to
effect the necessary changes.
Details follow:
USN-160-1 fixed two vulnerabilities in the Apache 2 server. The old
Apache 1 server was also vulnerable to one of the vulnerabilities
(CAN-2005-2088). Please note that Apache 1 is not officially supported
in Ubuntu (it is in the "universe" component of the archive).
For reference, this is the relevant part of the original advisory:
Watchfire discovered that Apache insufficiently verified the
"Transfer-Encoding" and "Content-Length" headers when acting as an
HTTP proxy. By sending a specially crafted HTTP request, a remote
attacker who is authorized to use the proxy could exploit this to
bypass web application firewalls, poison the HTTP proxy cache, and
conduct cross-site scripting attacks against other proxy users.
(CAN-2005-2088)
Updated packages for Ubuntu 4.10 (Warty Warthog):
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache_1.3.31-6ubuntu0.8.diff.gz
Size/MD5: 372493 c5001a1196912f3edfc785b5e2a5ebbc
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache_1.3.31-6ubuntu0.8.dsc
Size/MD5: 1102 c0f99d722fd5092be8c6cc800bc98020
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache_1.3.31.orig.tar.gz
Size/MD5: 3104170 ca475fbb40087eb157ec51334f260d1b
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-dev_1.3.31-6ubuntu0.8_all.deb
Size/MD5: 329846 42899fed4f93fc9aa98743ca8d6bbea1
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-doc_1.3.31-6ubuntu0.8_all.deb
Size/MD5: 1186908 e1bf21edf1a8dd848d6fff0ed9c15319
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-common_1.3.31-6ubuntu0.8_amd64.deb
Size/MD5: 873716 c70369c55517959829b6596efa3ac295
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1.3.31-6ubuntu0.8_amd64.deb
Size/MD5: 9131484 42174cf7f3b4054f1586e6ac0328180e
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1.3.31-6ubuntu0.8_amd64.deb
Size/MD5: 520854 389333cfe500df5fa2ddbb05acd39268
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1.3.31-6ubuntu0.8_amd64.deb
Size/MD5: 510938 856eb92f93f481c054b473699507b9e7
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-utils_1.3.31-6ubuntu0.8_amd64.deb
Size/MD5: 271648 1a4f48aa2a3218d148e11a8e83134326
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.31-6ubuntu0.8_amd64.deb
Size/MD5: 398398 9af432f952f18349223abdc14efbe5af
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/libapache-mod-perl_1.29.0.2.0-6ubuntu0.8_amd64.deb
Size/MD5: 491788 f5b1f7a21c419a2db9b8f8ecc8b00ada
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-common_1.3.31-6ubuntu0.8_i386.deb
Size/MD5: 838714 e50241ee55e408f5be6ee0ca528191f4
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1.3.31-6ubuntu0.8_i386.deb
Size/MD5: 9080744 0ddc1d368aceb07f7046d80d77e160b7
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1.3.31-6ubuntu0.8_i386.deb
Size/MD5: 494480 d0f38faf557c5606da32377bf860bc2d
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1.3.31-6ubuntu0.8_i386.deb
Size/MD5: 484248 932390c88b13b14a2d39ae85d4eb2c2c
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-utils_1.3.31-6ubuntu0.8_i386.deb
Size/MD5: 265448 5349d926e161a16b3416f273591454ef
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.31-6ubuntu0.8_i386.deb
Size/MD5: 377652 ccf175352ec693f8dcde9ee0b9005fbe
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/libapache-mod-perl_1.29.0.2.0-6ubuntu0.8_i386.deb
Size/MD5: 485142 09118f966d87a9ed22a00f8d641fae48
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-common_1.3.31-6ubuntu0.8_powerpc.deb
Size/MD5: 917796 42513834c278d8313e8ca1496a13a88b
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1.3.31-6ubuntu0.8_powerpc.deb
Size/MD5: 9226168 03fe292aac21254f752010e827ef82b7
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1.3.31-6ubuntu0.8_powerpc.deb
Size/MD5: 511502 4982e1ffb129cca49974208619502834
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1.3.31-6ubuntu0.8_powerpc.deb
Size/MD5: 507376 30d6000a4eebf427f18f9963d9bc94da
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-utils_1.3.31-6ubuntu0.8_powerpc.deb
Size/MD5: 278778 36a97646fdb52d9ef8ea93691aad2ab2
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.31-6ubuntu0.8_powerpc.deb
Size/MD5: 395824 7c4e799a6d4254614819de0a447bf4db
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/libapache-mod-perl_1.29.0.2.0-6ubuntu0.8_powerpc.deb
Size/MD5: 489118 ee494dbef77278e641ab54a4154de599
Updated packages for Ubuntu 5.04 (Hoary Hedgehog):
Source archives:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.33-4ubuntu1.diff.gz
Size/MD5: 364482 4fa62ef8a41a30d49f41f3248b0671d0
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.33-4ubuntu1.dsc
Size/MD5: 1121 cd89b81f9fc67b4d25cdc8b482e14bf8
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.33.orig.tar.gz
Size/MD5: 3105683 1a34f13302878a8713a2ac760d9b6da8
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dev_1.3.33-4ubuntu1_all.deb
Size/MD5: 331086 5dbb29add5c15b72a1901b653d22affd
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-doc_1.3.33-4ubuntu1_all.deb
Size/MD5: 1189152 f55d0f105549e660ff785b4f983df80d
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-utils_1.3.33-4ubuntu1_all.deb
Size/MD5: 211854 84bd3cb878b4c8125fc17b42497db935
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-common_1.3.33-4ubuntu1_amd64.deb
Size/MD5: 875046 c6bdfa39ba3a12c70b82824b955cb6ed
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1.3.33-4ubuntu1_amd64.deb
Size/MD5: 9163882 d0e9ec7f9d9a49a431f5fd97f93f6b87
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1.3.33-4ubuntu1_amd64.deb
Size/MD5: 522170 c54f45b7938d50f70a966aad92a673a0
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1.3.33-4ubuntu1_amd64.deb
Size/MD5: 512346 8a0bf2edac677b390b9f8c9b43c38c79
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.33-4ubuntu1_amd64.deb
Size/MD5: 399826 cde2880823c45ae1a57f3bd748d298b3
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/libapache-mod-perl_1.29.0.3-4ubuntu1_amd64.deb
Size/MD5: 492232 27674bfd322d2832e750d416d0159289
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-common_1.3.33-4ubuntu1_i386.deb
Size/MD5: 839554 6b29480273d1006da2515b2e0573e9d2
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1.3.33-4ubuntu1_i386.deb
Size/MD5: 9104572 b9d31e4995d51b303e99cf0268ca0f76
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1.3.33-4ubuntu1_i386.deb
Size/MD5: 495148 45ab419a9a5bc9d722f05b61d0e85628
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1.3.33-4ubuntu1_i386.deb
Size/MD5: 485346 20658ea1db74678ebb640fcabaa95359
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.33-4ubuntu1_i386.deb
Size/MD5: 378756 b6eb23b11d150e41ad0520595963dc12
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/libapache-mod-perl_1.29.0.3-4ubuntu1_i386.deb
Size/MD5: 485640 e9665bcc49dba12bb88d0dbbc91dc2ca
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-common_1.3.33-4ubuntu1_powerpc.deb
Size/MD5: 919468 1acb3a95dc392908764366eb7a9cf837
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1.3.33-4ubuntu1_powerpc.deb
Size/MD5: 9253540 b79b964d8b328168a5e84141369591b6
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1.3.33-4ubuntu1_powerpc.deb
Size/MD5: 513098 e3731ecc291e9f4a1b33909991973a5a
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1.3.33-4ubuntu1_powerpc.deb
Size/MD5: 508990 f93f9393257bfeb010757eca85067f77
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.33-4ubuntu1_powerpc.deb
Size/MD5: 397092 ec577980cf93a5de6f8ec7e5db0316a9
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/libapache-mod-perl_1.29.0.3-4ubuntu1_powerpc.deb
Size/MD5: 490332 6a06c0a6a65c34b48e99e5d666b35500
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Sep 07 2005
