[SECURITY] [DSA-133-1] apache-perl chunk handling vulnerability

Debian Security Advisory DSA-133-1 [email protected]
http://www.debian.org/security/ Daniel Jacobowitz
June 20, 2002

Package : apache-perl
Problem type : remote DoS / exploit
Debian-specific: no
CVE name : CAN-2002-0392
CERT advisory : VU#944335

Mark Litchfield found a denial of service attack in the Apache
web-server. While investigating the problem the Apache Software
Foundation discovered that the code for handling invalid requests which
use chunked encoding also might allow arbitrary code execution.

This has been fixed in version 1.3.9-14.1-1.21.20000309-1 of the Debian
apache-perl package and we recommand that you upgrade your apache-perl
package immediately.

An update for the soon to be released Debian GNU/Linux 3.0/woody
distribution will be available soon.

Debian 2.2 (stable)

Stable was released for alpha, arm, i386, m68k, powerpc and sparc.

Source archives:

http://security.debian.org/pool/updates/main/a/apache-perl/apache-perl_1.3.9-14.1-1.21.20000309-1.tar.gz
  Size/MD5 checksum:  2400948 c605ca35d8f2966bb9492eed91044bc7
http://security.debian.org/pool/updates/main/a/apache-perl/apache-perl_1.3.9-14.1-1.21.20000309-1.dsc
  Size/MD5 checksum:      651 443da7020c1c7418ab18dfc1d7e038d0

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/a/apache-perl/apache-perl_1.3.9-14.1-1.21.20000309-1_alpha.deb
  Size/MD5 checksum:  1126006 ba96b07901db27c2cb93955a948b24c4

arm architecture (Arm)

http://security.debian.org/pool/updates/main/a/apache-perl/apache-perl_1.3.9-14.1-1.21.20000309-1_arm.deb
  Size/MD5 checksum:   999428 204ca243c6eee9be766ff9321df02738

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/a/apache-perl/apache-perl_1.3.9-14.1-1.21.20000309-1_i386.deb
  Size/MD5 checksum:   957686 d382ae4378af7726b4c39eb8127c1323

m68k architecture (Motorola Mc680x0)

http://security.debian.org/pool/updates/main/a/apache-perl/apache-perl_1.3.9-14.1-1.21.20000309-1_m68k.deb
  Size/MD5 checksum:   922138 ef96bb1a914baa018c760e4773a64f33

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/a/apache-perl/apache-perl_1.3.9-14.1-1.21.20000309-1_powerpc.deb
  Size/MD5 checksum:  1004242 d505c34f337997b328c2fc80cbd3ae48

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/a/apache-perl/apache-perl_1.3.9-14.1-1.21.20000309-1_sparc.deb
  Size/MD5 checksum:  1001636 67f46e59bfa545acead0d0fbd0a6aca8

Obtaining updates:

By hand:

wget URL
    will fetch the file for you.
dpkg -i FILENAME.deb
    will install the fetched file.

With apt:

deb http://security.debian.org/ potato/updates main
    added to /etc/apt/sources.list will give you access to potato updates.
deb http://security.debian.org/ woody/updates main
    added to /etc/apt/sources.list will give you access to woody updates.

Mailing list:
[email protected]