[SECURITY] [DSA 1740-1] New yaws packages fix denial of service

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: [SECURITY] [DSA 1740-1] New yaws packages fix denial of service
From: white@xxxxxxxxxx (Steffen Joeris)
Date: Sat, 14 Mar 2009 15:07:11 +1100 (EST)
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mail-followup-to: bugtraq@xxxxxxxxxxxxxxxxx
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Old-return-path: <white@xxxxxxxxxx>
Priority: urgent
Reply-to: listadmin@xxxxxxxxxxxxxxxxx
Resent-cc: recipient list not shown: ;
Resent-date: Sat, 14 Mar 2009 04:07:35 +0000 (UTC)
Resent-from: list@xxxxxxxxxxxxxxxx (Mailing List Manager)
Resent-message-id: <KB_gGzbIoOD.A.WwF.H2yuJB@liszt>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1740-1             security@xxxxxxxxxx
http://www.debian.org/security/                         Steffen Joeris
March 14, 2009                   http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : yaws
Vulnerability  : denial of service
Problem type   : remote
Debian-specific: no
CVE Id         : CVE-2009-0751


It was discovered that yaws, a high performance HTTP 1.1 webserver, is
prone to a denial of service attack via a request with a large HTTP
header.

For the stable distribution (lenny), this problem has been fixed in
version 1.77-3+lenny1.

For the oldstable distribution (etch), this problem has been fixed in
version 1.65-4etch1.

For the testing distribution (squeeze) and the unstable distribution
(sid), this problem has been fixed in version 1.80-1.

We recommend that you upgrade your yaws package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, 
mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1.diff.gz
    Size/MD5 checksum:    15050 de600331ea301eb9a8cd82987bbecac1
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1.dsc
    Size/MD5 checksum:      742 5ff0d18eaf5b0982cab087a0da30546b
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65.orig.tar.gz
    Size/MD5 checksum:   775978 4c08ba6abb40e41a49066a4c35d66102

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_alpha.deb
    Size/MD5 checksum:   920326 bcdde19abfa0509a7fec5980ae4c6977

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_amd64.deb
    Size/MD5 checksum:   922808 f69d7ec4e1082067e8ce2c5b35088ed7

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_arm.deb
    Size/MD5 checksum:   921284 74360fb5c5ace09cde4a0afe9612b35e

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_i386.deb
    Size/MD5 checksum:   923758 b6f68cab4953d114197eecef7e89a5d7

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_ia64.deb
    Size/MD5 checksum:   921190 be465d69af82a67b1d0a5e4bf6e21984

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_mips.deb
    Size/MD5 checksum:   923582 fa6d77670fee39cfc6bd1cd0c5532786

mipsel architecture (MIPS (Little Endian))

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_mipsel.deb
    Size/MD5 checksum:   919572 a235d55de32b60a838b0ca92fa2e5308

powerpc architecture (PowerPC)

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_powerpc.deb
    Size/MD5 checksum:   920814 23d52c172afae1269fccc7a536418fbe

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_s390.deb
    Size/MD5 checksum:   919460 39fca419254eaca0a843e4d5a8abfd5e

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_sparc.deb
    Size/MD5 checksum:   784600 ab81930fb47510802e13cd26cad09c73


Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, 
mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77.orig.tar.gz
    Size/MD5 checksum:   838170 7e01d9e8f4fe12895c76081ee4cf7754
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1.dsc
    Size/MD5 checksum:     1206 6b5844871553c42a824f401586aa46a1
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1.diff.gz
    Size/MD5 checksum:    19814 253cfc5da27428df313c4e8b4dfbf93a

Architecture independent packages:

  
http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+lenny1_all.deb
    Size/MD5 checksum:   200784 8731c7f94f6f3550f142f21d225d918d
  
http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+lenny1_all.deb
    Size/MD5 checksum:    65076 65681b94bf96027c0684bb2d29db00e8
  
http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+lenny1_all.deb
    Size/MD5 checksum:   160840 efdcebae480d452dc628eb715e7f8b22
  
http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+lenny1_all.deb
    Size/MD5 checksum:    66196 b281bb1587101a3e83d50ffe1e92f6fd

alpha architecture (DEC Alpha)

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_alpha.deb
    Size/MD5 checksum:   652508 3e474dff842f080a6897958243c6c0d8

amd64 architecture (AMD x86_64 (AMD64))

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_amd64.deb
    Size/MD5 checksum:   652258 03053ee15e1b92456785a08e91e5d7e5

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_arm.deb
    Size/MD5 checksum:   651702 06e61922443dc30ab4c0b144c34a7a2e

armel architecture (ARM EABI)

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_armel.deb
    Size/MD5 checksum:   649654 d752e8341ad8797bd0fb5879e53f07dd

hppa architecture (HP PA RISC)

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_hppa.deb
    Size/MD5 checksum:   652286 a87d4e8c7ed413812f8b59311c55a689

i386 architecture (Intel ia32)

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_i386.deb
    Size/MD5 checksum:   652642 de9b389be1cb7842b0d8584e0d0a1b18

ia64 architecture (Intel ia64)

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_ia64.deb
    Size/MD5 checksum:   653308 f9b75201e1191fb8dd7cf158631a9c89

mips architecture (MIPS (Big Endian))

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_mips.deb
    Size/MD5 checksum:   653008 874547bac10ca979bfeeb065ed895bff

mipsel architecture (MIPS (Little Endian))

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_mipsel.deb
    Size/MD5 checksum:   651392 37c53dd40471f02f2dfea75c788ea5f5

powerpc architecture (PowerPC)

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_powerpc.deb
    Size/MD5 checksum:   654140 c90a7a7f66fd0e2093d502a5893d9e08

s390 architecture (IBM S/390)

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_s390.deb
    Size/MD5 checksum:   651624 e7ecaf982f7f027475b3c8275e63c8c8

sparc architecture (Sun SPARC/UltraSPARC)

  
http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_sparc.deb
    Size/MD5 checksum:   651006 6fbb95dace09ead71d6f335322de5171


  These files will probably be moved into the stable distribution on
  its next update.

- 
---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security 
dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkm7LO4ACgkQ62zWxYk/rQdLPwCgiQCckKhuLsS4B83cecLEAJDZ
UW4AnR9/NGpPSBMOujTAco1HIyN63bu1
=oT4G
-----END PGP SIGNATURE-----

Prev by Date: Infopop UBB.Threads Admin Credentials via SQL Injection
Next by Date: [SECURITY] [DSA 1741-1] New psi packages fix denial of service
Previous by thread: Infopop UBB.Threads Admin Credentials via SQL Injection
Next by thread: [SECURITY] [DSA 1741-1] New psi packages fix denial of service
Index(es):
- Date
- Thread