Debian: DSA-1740-1: New yaws packages fix denial of service

    Date14 Mar 2009
    CategoryDebian
    46
    Posted ByLinuxSecurity Advisories
    It was discovered that yaws, a high performance HTTP 1.1 webserver, is prone to a denial of service attack via a request with a large HTTP header.
    
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1740-1             This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                         Steffen Joeris
    March 14, 2009                   http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : yaws
    Vulnerability  : denial of service
    Problem type   : remote
    Debian-specific: no
    CVE Id         : CVE-2009-0751
    
    
    It was discovered that yaws, a high performance HTTP 1.1 webserver, is
    prone to a denial of service attack via a request with a large HTTP
    header.
    
    For the stable distribution (lenny), this problem has been fixed in
    version 1.77-3+lenny1.
    
    For the oldstable distribution (etch), this problem has been fixed in
    version 1.65-4etch1.
    
    For the testing distribution (squeeze) and the unstable distribution
    (sid), this problem has been fixed in version 1.80-1.
    
    We recommend that you upgrade your yaws package.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Debian (oldstable)
    - ------------------
    
    Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1.diff.gz
        Size/MD5 checksum:    15050 de600331ea301eb9a8cd82987bbecac1
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1.dsc
        Size/MD5 checksum:      742 5ff0d18eaf5b0982cab087a0da30546b
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65.orig.tar.gz
        Size/MD5 checksum:   775978 4c08ba6abb40e41a49066a4c35d66102
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_alpha.deb
        Size/MD5 checksum:   920326 bcdde19abfa0509a7fec5980ae4c6977
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_amd64.deb
        Size/MD5 checksum:   922808 f69d7ec4e1082067e8ce2c5b35088ed7
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_arm.deb
        Size/MD5 checksum:   921284 74360fb5c5ace09cde4a0afe9612b35e
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_i386.deb
        Size/MD5 checksum:   923758 b6f68cab4953d114197eecef7e89a5d7
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_ia64.deb
        Size/MD5 checksum:   921190 be465d69af82a67b1d0a5e4bf6e21984
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_mips.deb
        Size/MD5 checksum:   923582 fa6d77670fee39cfc6bd1cd0c5532786
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_mipsel.deb
        Size/MD5 checksum:   919572 a235d55de32b60a838b0ca92fa2e5308
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_powerpc.deb
        Size/MD5 checksum:   920814 23d52c172afae1269fccc7a536418fbe
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_s390.deb
        Size/MD5 checksum:   919460 39fca419254eaca0a843e4d5a8abfd5e
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_sparc.deb
        Size/MD5 checksum:   784600 ab81930fb47510802e13cd26cad09c73
    
    
    Debian GNU/Linux 5.0 alias lenny
    - --------------------------------
    
    Debian (stable)
    - ---------------
    
    Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77.orig.tar.gz
        Size/MD5 checksum:   838170 7e01d9e8f4fe12895c76081ee4cf7754
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1.dsc
        Size/MD5 checksum:     1206 6b5844871553c42a824f401586aa46a1
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1.diff.gz
        Size/MD5 checksum:    19814 253cfc5da27428df313c4e8b4dfbf93a
    
    Architecture independent packages:
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+lenny1_all.deb
        Size/MD5 checksum:   200784 8731c7f94f6f3550f142f21d225d918d
      http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+lenny1_all.deb
        Size/MD5 checksum:    65076 65681b94bf96027c0684bb2d29db00e8
      http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+lenny1_all.deb
        Size/MD5 checksum:   160840 efdcebae480d452dc628eb715e7f8b22
      http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+lenny1_all.deb
        Size/MD5 checksum:    66196 b281bb1587101a3e83d50ffe1e92f6fd
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_alpha.deb
        Size/MD5 checksum:   652508 3e474dff842f080a6897958243c6c0d8
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_amd64.deb
        Size/MD5 checksum:   652258 03053ee15e1b92456785a08e91e5d7e5
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_arm.deb
        Size/MD5 checksum:   651702 06e61922443dc30ab4c0b144c34a7a2e
    
    armel architecture (ARM EABI)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_armel.deb
        Size/MD5 checksum:   649654 d752e8341ad8797bd0fb5879e53f07dd
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_hppa.deb
        Size/MD5 checksum:   652286 a87d4e8c7ed413812f8b59311c55a689
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_i386.deb
        Size/MD5 checksum:   652642 de9b389be1cb7842b0d8584e0d0a1b18
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_ia64.deb
        Size/MD5 checksum:   653308 f9b75201e1191fb8dd7cf158631a9c89
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_mips.deb
        Size/MD5 checksum:   653008 874547bac10ca979bfeeb065ed895bff
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_mipsel.deb
        Size/MD5 checksum:   651392 37c53dd40471f02f2dfea75c788ea5f5
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_powerpc.deb
        Size/MD5 checksum:   654140 c90a7a7f66fd0e2093d502a5893d9e08
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_s390.deb
        Size/MD5 checksum:   651624 e7ecaf982f7f027475b3c8275e63c8c8
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_sparc.deb
        Size/MD5 checksum:   651006 6fbb95dace09ead71d6f335322de5171
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"40","type":"x","order":"1","pct":48.78,"resources":[]},{"id":"88","title":"Should be more technical","votes":"13","type":"x","order":"2","pct":15.85,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"29","type":"x","order":"3","pct":35.37,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.