Debian: DSA-1740-1: New yaws packages fix denial of service

    Date14 Mar 2009
    CategoryDebian
    26
    Posted ByLinuxSecurity Advisories
    It was discovered that yaws, a high performance HTTP 1.1 webserver, is prone to a denial of service attack via a request with a large HTTP header.
    
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1740-1             This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                         Steffen Joeris
    March 14, 2009                   http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : yaws
    Vulnerability  : denial of service
    Problem type   : remote
    Debian-specific: no
    CVE Id         : CVE-2009-0751
    
    
    It was discovered that yaws, a high performance HTTP 1.1 webserver, is
    prone to a denial of service attack via a request with a large HTTP
    header.
    
    For the stable distribution (lenny), this problem has been fixed in
    version 1.77-3+lenny1.
    
    For the oldstable distribution (etch), this problem has been fixed in
    version 1.65-4etch1.
    
    For the testing distribution (squeeze) and the unstable distribution
    (sid), this problem has been fixed in version 1.80-1.
    
    We recommend that you upgrade your yaws package.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Debian (oldstable)
    - ------------------
    
    Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1.diff.gz
        Size/MD5 checksum:    15050 de600331ea301eb9a8cd82987bbecac1
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1.dsc
        Size/MD5 checksum:      742 5ff0d18eaf5b0982cab087a0da30546b
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65.orig.tar.gz
        Size/MD5 checksum:   775978 4c08ba6abb40e41a49066a4c35d66102
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_alpha.deb
        Size/MD5 checksum:   920326 bcdde19abfa0509a7fec5980ae4c6977
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_amd64.deb
        Size/MD5 checksum:   922808 f69d7ec4e1082067e8ce2c5b35088ed7
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_arm.deb
        Size/MD5 checksum:   921284 74360fb5c5ace09cde4a0afe9612b35e
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_i386.deb
        Size/MD5 checksum:   923758 b6f68cab4953d114197eecef7e89a5d7
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_ia64.deb
        Size/MD5 checksum:   921190 be465d69af82a67b1d0a5e4bf6e21984
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_mips.deb
        Size/MD5 checksum:   923582 fa6d77670fee39cfc6bd1cd0c5532786
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_mipsel.deb
        Size/MD5 checksum:   919572 a235d55de32b60a838b0ca92fa2e5308
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_powerpc.deb
        Size/MD5 checksum:   920814 23d52c172afae1269fccc7a536418fbe
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_s390.deb
        Size/MD5 checksum:   919460 39fca419254eaca0a843e4d5a8abfd5e
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_sparc.deb
        Size/MD5 checksum:   784600 ab81930fb47510802e13cd26cad09c73
    
    
    Debian GNU/Linux 5.0 alias lenny
    - --------------------------------
    
    Debian (stable)
    - ---------------
    
    Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77.orig.tar.gz
        Size/MD5 checksum:   838170 7e01d9e8f4fe12895c76081ee4cf7754
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1.dsc
        Size/MD5 checksum:     1206 6b5844871553c42a824f401586aa46a1
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1.diff.gz
        Size/MD5 checksum:    19814 253cfc5da27428df313c4e8b4dfbf93a
    
    Architecture independent packages:
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+lenny1_all.deb
        Size/MD5 checksum:   200784 8731c7f94f6f3550f142f21d225d918d
      http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+lenny1_all.deb
        Size/MD5 checksum:    65076 65681b94bf96027c0684bb2d29db00e8
      http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+lenny1_all.deb
        Size/MD5 checksum:   160840 efdcebae480d452dc628eb715e7f8b22
      http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+lenny1_all.deb
        Size/MD5 checksum:    66196 b281bb1587101a3e83d50ffe1e92f6fd
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_alpha.deb
        Size/MD5 checksum:   652508 3e474dff842f080a6897958243c6c0d8
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_amd64.deb
        Size/MD5 checksum:   652258 03053ee15e1b92456785a08e91e5d7e5
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_arm.deb
        Size/MD5 checksum:   651702 06e61922443dc30ab4c0b144c34a7a2e
    
    armel architecture (ARM EABI)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_armel.deb
        Size/MD5 checksum:   649654 d752e8341ad8797bd0fb5879e53f07dd
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_hppa.deb
        Size/MD5 checksum:   652286 a87d4e8c7ed413812f8b59311c55a689
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_i386.deb
        Size/MD5 checksum:   652642 de9b389be1cb7842b0d8584e0d0a1b18
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_ia64.deb
        Size/MD5 checksum:   653308 f9b75201e1191fb8dd7cf158631a9c89
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_mips.deb
        Size/MD5 checksum:   653008 874547bac10ca979bfeeb065ed895bff
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_mipsel.deb
        Size/MD5 checksum:   651392 37c53dd40471f02f2dfea75c788ea5f5
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_powerpc.deb
        Size/MD5 checksum:   654140 c90a7a7f66fd0e2093d502a5893d9e08
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_s390.deb
        Size/MD5 checksum:   651624 e7ecaf982f7f027475b3c8275e63c8c8
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1_sparc.deb
        Size/MD5 checksum:   651006 6fbb95dace09ead71d6f335322de5171
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    Do you read our distribution advisories on a regular basis?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /component/communitypolls/?task=poll.vote&format=json
    23
    radio
    [{"id":"84","title":"Yes, for a single distribution","votes":"0","type":"x","order":"1","pct":0,"resources":[]},{"id":"85","title":"Yes, for multiple distributions","votes":"6","type":"x","order":"2","pct":60,"resources":[]},{"id":"86","title":"No","votes":"4","type":"x","order":"3","pct":40,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.