Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2008.0705 -- [UNIX/Linux][Debian] New lighttpd packages fix multiple DOS issues 16 July 2008 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: lighttpd Publisher: Debian Operating System: Debian GNU/Linux 4.0 UNIX variants (UNIX, Linux, OSX) Impact: Denial of Service Access: Remote/Unauthenticated CVE Names: CVE-2008-0983 CVE-2007-3948 Ref: ESB-2008.0237 Original Bulletin: http://www.debian.org/security/2008/dsa-1609 Comment: This advisory references vulnerabilities in products which run on platforms other than Debian. It is recommended that administrators running lighttpd check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - ------------------------------------------------------------------------ Debian Security Advisory DSA-1609-1 security@debian.org http://www.debian.org/security/ Steve Kemp July 15, 2008 http://www.debian.org/security/faq - - ------------------------------------------------------------------------ Package : lighttpd Vulnerability : various Problem type : remote Debian-specific: no CVE Id(s) : CVE-2008-0983 CVE-2007-3948 Debian Bug : 434888 466663 Several local/remote vulnerabilities have been discovered in lighttpd, a fast webserver with minimal memory footprint. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-0983 lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access. CVE-2007-3948 connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service (failed assertion) via a large number of connection attempts. For the stable distribution (etch), these problems have been fixed in version 1.4.13-4etch9. For the unstable distribution (sid), these problems have been fixed in version 1.4.18-2. We recommend that you upgrade your lighttpd package. Upgrade instructions - - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - - ------------------------------- Source archives: http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9.dsc Size/MD5 checksum: 1106 b9e468fa16bb1874ceef9596827a0aee http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13.orig.tar.gz Size/MD5 checksum: 793309 3a64323b8482b0e8a6246dbfdb4c39dc http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9.diff.gz Size/MD5 checksum: 37524 b935ac31122e596b50393b32412c4634 Architecture independent packages: http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1.4.13-4etch9_all.deb Size/MD5 checksum: 99444 f4da891e3055833d72cedb093ebe961b alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_alpha.deb Size/MD5 checksum: 65236 07a7c10a1a9e8e5be6591eafdcb2af70 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_alpha.deb Size/MD5 checksum: 319704 347221cd0521559c703e77a638101378 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_alpha.deb Size/MD5 checksum: 59970 cd8eebac5cafbfc86a94b7bdec622cdc http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_alpha.deb Size/MD5 checksum: 71720 2243711e9b479e7201bd075375341570 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_alpha.deb Size/MD5 checksum: 61748 e082eba9bed47e7d41b97b8c3faf2ab4 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_alpha.deb Size/MD5 checksum: 64804 2300124052e6cd3d16b5d912771a43d2 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_amd64.deb Size/MD5 checksum: 70042 f216ba125297f9617e9b93ae5e9c1528 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_amd64.deb Size/MD5 checksum: 60890 0cf8ebc595c92cf0e5133cfb0fdb45f1 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_amd64.deb Size/MD5 checksum: 64028 22bef6211d9afd320292721a796671fb http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_amd64.deb Size/MD5 checksum: 63726 1908fe9c6b35d03ac8cb8ca25bc119a8 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_amd64.deb Size/MD5 checksum: 59294 a0bc743d9720b97db28764c6c1e0f79c http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_amd64.deb Size/MD5 checksum: 297536 0de34b9f4ef546ae5f38991f4676143a arm architecture (ARM) http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_arm.deb Size/MD5 checksum: 63132 28b693dd3dc65d743e84af5249e6867e http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_arm.deb Size/MD5 checksum: 69696 7c49c8c4dc0ae30526d0ccd02cec9376 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_arm.deb Size/MD5 checksum: 60870 bb8fa82a14b51ddf0c4de1e869755459 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_arm.deb Size/MD5 checksum: 62936 e831e83489ced32abeeae5c4a9b26e01 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_arm.deb Size/MD5 checksum: 286636 77d3c387d79492d0655bf45930ed774a http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_arm.deb Size/MD5 checksum: 58744 7fe590b4b243a5d33f9328d23c25f037 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_hppa.deb Size/MD5 checksum: 65586 fc9bc390e05808b64c7f3323465f3860 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_hppa.deb Size/MD5 checksum: 59958 3ba195a79e46a6e896482ffd79121daf http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_hppa.deb Size/MD5 checksum: 65072 7f750a4b25c1449c76216a4006bed3ef http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_hppa.deb Size/MD5 checksum: 61960 98543c413da83a34f1a066ea6701b4b8 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_hppa.deb Size/MD5 checksum: 73006 d49b3f59f4014f2982157b383667d6f4 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_hppa.deb Size/MD5 checksum: 324090 bb1800b50a874f7286bd8d2a6bd69806 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_i386.deb Size/MD5 checksum: 289054 9d101f135f459437d125ea443d0f3652 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_i386.deb Size/MD5 checksum: 71210 9a6962f56b581b73320e0e8d75166aa3 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_i386.deb Size/MD5 checksum: 64018 864494c387986f427f3fa35a3eb8e688 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_i386.deb Size/MD5 checksum: 61270 45f87772bf860aa3463927599555948e http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_i386.deb Size/MD5 checksum: 64260 7084c5bb2d0145dab2ce6902d4b3f251 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_i386.deb Size/MD5 checksum: 59494 eb4ce22389b5eacbe7f279731f89dad7 mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_mips.deb Size/MD5 checksum: 58634 2dead181d2874aba311da3c28ae5ce00 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_mips.deb Size/MD5 checksum: 296406 64a97a2fcd2d78a4e3a9e1c57253c5ad http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_mips.deb Size/MD5 checksum: 60026 bccc394d18921f666d9cda04f6c50e6e http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_mips.deb Size/MD5 checksum: 69302 003ca7f181dead692e8070206ec555f8 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_mips.deb Size/MD5 checksum: 62598 027b727988bc41f1f61bf208dbffd03e http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_mips.deb Size/MD5 checksum: 62724 16f4243a6d66a7e0cfea2a2c5430eed4 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_powerpc.deb Size/MD5 checksum: 324104 ff3b010a174d956f4b2e1d4907883290 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_powerpc.deb Size/MD5 checksum: 65190 ed5a4ddac8ea7fa260b3ffed37b03b84 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_powerpc.deb Size/MD5 checksum: 65462 c5777f10ab6a3ee8776d71c53808143c http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_powerpc.deb Size/MD5 checksum: 60718 c8c9da07c137e73c16fda7e1347a61b4 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_powerpc.deb Size/MD5 checksum: 62528 407cf5d91565f8d22cb54e540e95cec0 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_powerpc.deb Size/MD5 checksum: 71840 2d40c1080b696a949262cf19dafa93b7 s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_s390.deb Size/MD5 checksum: 59730 aa85c7a60138cd531b2693a0f02e7466 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_s390.deb Size/MD5 checksum: 64778 351ff20233c9ac9c897489b04129976f http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_s390.deb Size/MD5 checksum: 307340 b84df276716669831f54ca5926158ba0 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_s390.deb Size/MD5 checksum: 71520 960bbc9184cda5625fec9e5c8f721751 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_s390.deb Size/MD5 checksum: 61230 c5bc149d49c8c8c0eadb53098c5802b8 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_s390.deb Size/MD5 checksum: 64392 4505fe625ce17c305a79c74226150150 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_sparc.deb Size/MD5 checksum: 284464 660005588988330ef2742e208e18b1ed http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_sparc.deb Size/MD5 checksum: 58928 739d374e9412b1c33ffcc4d84e06ff4c http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_sparc.deb Size/MD5 checksum: 63490 57c717bbd4a6c7a27c2b3ce664b447c6 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_sparc.deb Size/MD5 checksum: 60574 0fe2a1a268d154fdb6a11ef33a7c9a9f http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_sparc.deb Size/MD5 checksum: 63466 bbb49f9396ba560a5db3d4f30a78ab02 http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_sparc.deb Size/MD5 checksum: 69956 cc2a681cb6e423b0d91aca6691628088 These files will probably be moved into the stable distribution on its next update. - - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFIfOCUwM/Gs81MDZ0RApRfAJ0Yr6Tx0h+vAcGltMBDm9UR0xt1FgCgvdjB u5rYlGkaCIWkyVmS0XjNLao= =Z6rM - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBSH0+0Ch9+71yA2DNAQIqoAP/S60JJM/D6H0oaLJwy9l+Wmk1ahPS9Aej 38tdPfgQZiGqa/tr7BprSb656QW/TG+KABKgJ7mI5yIowGEa3dxowQuTcgaTYX/0 KMlwcJuF0bTeo4+rkhcnKqERmuVQzQhKyVjnqiEhzXGaIGFbLciEMVHv0Z/D0YvB lH6YJSpOhRs= =7Y3s -----END PGP SIGNATURE-----