Debian: New lighttpd packages fix denial of service

    Date10 Jun 2007
    CategoryDebian
    7682
    Posted ByLinuxSecurity Advisories
    Two problems were discovered with lighttpd, a fast webserver with minimal memory footprint, which could allow denial of service. The Common Vulnerabilities and Exposures project identifies problems. One is a remote attackers could cause denial of service by disconnecting partway through making a request.
    - --------------------------------------------------------------------------
    Debian Security Advisory DSA 1303-1                    This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                                 Steve Kemp
    June 10, 2007                           http://www.debian.org/security/faq
    - --------------------------------------------------------------------------
    
    Package        : lighttpd 
    Vulnerability  : denial of service
    Problem-Type   : local & remote
    Debian-specific: no
    CVE ID         : CVE-2007-1870 CVE-2007-1869
    Debian Bug     : 422254 
    
    Two problems were discovered with lighttpd, a fast webserver with
    minimal memory footprint, which could allow denial of service.
    The Common Vulnerabilities and Exposures project identifies the
    following problems:
    
    CVE-2007-1869
    
      Remote attackers could cause denial of service by disconnecting
      partway through making a request.
    
    CVE-2007-1870
    
      A NULL pointer dereference could cause a crash when serving files
      with a mtime of 0.
    
    
    For the stable distribution (etch) these problems have been fixed in
    version 1.4.13-4etch1.
    
    For the unstable distribution (sid) these problems have been fixed in
    version 1.4.14-1.
    
    We recommend that you upgrade your lighttpd package.
    
    
    Upgrade Instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
      Source archives:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1.dsc
          Size/MD5 checksum:     1098 ef3730d86ea77e526e66127d934f03c6
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1.diff.gz
          Size/MD5 checksum:    15173 411d82d078a5303943389fc3521e7fba
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13.orig.tar.gz
          Size/MD5 checksum:   793309 3a64323b8482b0e8a6246dbfdb4c39dc
    
      Architecture independent components:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1.4.13-4etch1_all.deb
          Size/MD5 checksum:    99474 8a94fa9556f1429528319f1a1fa568f1
    
      Alpha architecture:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1_alpha.deb
          Size/MD5 checksum:   318162 283fd8d6c7c27f4bd61898247da07db9
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch1_alpha.deb
          Size/MD5 checksum:    64510 d0944bbc86a22daa45999afd00676920
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch1_alpha.deb
          Size/MD5 checksum:    64070 d685ea88c4b629bab5771d08621aa81c
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch1_alpha.deb
          Size/MD5 checksum:    59074 aad74a6b17e86c8c68b63717b4448e22
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch1_alpha.deb
          Size/MD5 checksum:    60828 c136287cae4f4cea113657ea6b01ce41
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch1_alpha.deb
          Size/MD5 checksum:    71320 bc0aa14a9955e2f386fbb43c6061ff8b
    
      AMD64 architecture:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1_amd64.deb
          Size/MD5 checksum:   296426 7cbf0ee2b5a3c27b3478ae096419beef
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch1_amd64.deb
          Size/MD5 checksum:    63922 981c2f63505bd5394c639a1aa93fa25a
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch1_amd64.deb
          Size/MD5 checksum:    63646 d4ec90dda80422e47115faf57396bb05
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch1_amd64.deb
          Size/MD5 checksum:    59132 a6cc6145c017eae377b20887dae4618c
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch1_amd64.deb
          Size/MD5 checksum:    60724 6a6af3f67680ea042ea5e8a6d2170139
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch1_amd64.deb
          Size/MD5 checksum:    69976 739708ec1200c70a6cc4b468080b49ae
    
      ARM architecture:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1_arm.deb
          Size/MD5 checksum:   288014 1114e00e94dc60364fa9aaad59183836
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch1_arm.deb
          Size/MD5 checksum:    62602 9947d36ac758e7d7cd78064c147ddbe2
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch1_arm.deb
          Size/MD5 checksum:    62462 220505089fe300fcce338cc730b7cfb2
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch1_arm.deb
          Size/MD5 checksum:    58360 ca58297fd12f1b62af27a85fddcf47ad
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch1_arm.deb
          Size/MD5 checksum:    60284 dce6b3c544c0e3bd2f8c08a88cfcb6f2
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch1_arm.deb
          Size/MD5 checksum:    69420 a889e304aab96e8be3638ce6a16ca1c3
    
      HP Precision architecture:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1_hppa.deb
          Size/MD5 checksum:   323150 e49e128dcd9d3d38d08aeaa1fae889cd
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch1_hppa.deb
          Size/MD5 checksum:    64930 a3a60a655c7f06f38ddd71df3d1c2b48
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch1_hppa.deb
          Size/MD5 checksum:    64418 9fad81697a0dac3aa1f64cf2ea4a93b2
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch1_hppa.deb
          Size/MD5 checksum:    59432 29c07432b0d96cc11d4794a6f618c94e
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch1_hppa.deb
          Size/MD5 checksum:    61198 70155f2b1dce10205822cf14639eedcf
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch1_hppa.deb
          Size/MD5 checksum:    72464 d51a480afe5e07b0335332e7b24085bb
    
      Intel IA-32 architecture:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1_i386.deb
          Size/MD5 checksum:   288108 06270ce40db3249625b3123afe20f545
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch1_i386.deb
          Size/MD5 checksum:    63110 a01ca815790e6579c308eb364fbf0b9e
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch1_i386.deb
          Size/MD5 checksum:    62910 17903e4397ba40d9b1fafaae03aeba67
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch1_i386.deb
          Size/MD5 checksum:    58516 ffd4e5175a0771229aa9ec0ee462367c
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch1_i386.deb
          Size/MD5 checksum:    60178 a6e7d1e4431950bb1cb9c8ed02d8796e
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch1_i386.deb
          Size/MD5 checksum:    70212 797fbce72817ed3092d0756d4f0b7b16
    
      Intel IA-64 architecture:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1_ia64.deb
          Size/MD5 checksum:   402620 ee76492e203b1c42459a9d35708c15d1
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch1_ia64.deb
          Size/MD5 checksum:    66974 14dfec6e97a3fffe45c8c8d2b1c263c7
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch1_ia64.deb
          Size/MD5 checksum:    66822 c8761bdad0192b709a6650935a73b77e
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch1_ia64.deb
          Size/MD5 checksum:    60666 a51f5988e23c3cb01ba872556e666c67
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch1_ia64.deb
          Size/MD5 checksum:    62532 306c5d1b0744c9a55bdbc5a3e6ab9d43
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch1_ia64.deb
          Size/MD5 checksum:    76526 1d46f971460f6bc919cbe4ae68f7049e
    
      Big endian MIPS architecture:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1_mips.deb
          Size/MD5 checksum:   295572 d4eff501f522141341fd0d42a7643e50
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch1_mips.deb
          Size/MD5 checksum:    62994 a42afe38e858bdc97e3d1cc2609040cd
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch1_mips.deb
          Size/MD5 checksum:    62832 21d9359dee2346189cb50bf6ce743fc5
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch1_mips.deb
          Size/MD5 checksum:    58804 1f3c6acfdd1500b1a44384cf013368e1
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch1_mips.deb
          Size/MD5 checksum:    60240 f06fa483be4d888fe6161d4343232879
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch1_mips.deb
          Size/MD5 checksum:    69504 53b09dd48fdcb378b8ebfb1ba4d71703
    
      Little endian MIPS architecture:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1_mipsel.deb
          Size/MD5 checksum:   296010 71a9419f817392755394718a35f176c0
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch1_mipsel.deb
          Size/MD5 checksum:    63028 d66cf97cf28ee0657b17f5357333b063
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch1_mipsel.deb
          Size/MD5 checksum:    62854 7861b0cd64b100a068bfebd841d12488
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch1_mipsel.deb
          Size/MD5 checksum:    58776 2af4301d158b3143d3b40e4aab618f74
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch1_mipsel.deb
          Size/MD5 checksum:    60248 839ad9fbbc65f5d873033599a5933b8e
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch1_mipsel.deb
          Size/MD5 checksum:    69494 c76e5480bafdcfcc6ae021aa1000c8b2
    
      PowerPC architecture:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1_powerpc.deb
          Size/MD5 checksum:   322174 74b0047df6db5edb00d9d2691c8f064c
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch1_powerpc.deb
          Size/MD5 checksum:    64874 17f172304062df3885814aa40abfaf19
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch1_powerpc.deb
          Size/MD5 checksum:    64516 542119472a68eae891b70b408425e5c1
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch1_powerpc.deb
          Size/MD5 checksum:    60134 7404bfe78362b08fa558310c38809521
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch1_powerpc.deb
          Size/MD5 checksum:    61946 caed2baa31f06fc1e7d96007c6d33b98
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch1_powerpc.deb
          Size/MD5 checksum:    71244 31d0392efa451d605daa53846388a9fb
    
      IBM S/390 architecture:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1_s390.deb
          Size/MD5 checksum:   306018 a2a8aaf5a00d7ffdc4a90be4c891e68a
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch1_s390.deb
          Size/MD5 checksum:    64108 b698d116eccc8373cd0d35efd704b8d5
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch1_s390.deb
          Size/MD5 checksum:    63718 cfa9c3c452641911f3dc47aa014f717d
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch1_s390.deb
          Size/MD5 checksum:    59080 d5edfcdfae8a88781869dc800317895b
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch1_s390.deb
          Size/MD5 checksum:    60572 66ffe78d259ed3c27ee59e9e62c162d1
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch1_s390.deb
          Size/MD5 checksum:    70756 bc6cb87a363b8007bee03d1383f4c7af
    
      Sun Sparc architecture:
    
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch1_sparc.deb
          Size/MD5 checksum:   283110 f6e58d1dc5993bad86eeac3d322c4f96
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch1_sparc.deb
          Size/MD5 checksum:    62912 61868c7b6990c7c358643edb63bb9d2f
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch1_sparc.deb
          Size/MD5 checksum:    62884 983eee1671580a04506e6353a119c1ab
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch1_sparc.deb
          Size/MD5 checksum:    58356 f5a3f3eb5caaac0966e64a463eb8635c
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch1_sparc.deb
          Size/MD5 checksum:    60002 39e417cc65309ed2aeee7f7c91a607cb
        http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch1_sparc.deb
          Size/MD5 checksum:    69364 dc30f534d4bb72a97b62f3c4f59fdaf6
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"40","type":"x","order":"1","pct":48.78,"resources":[]},{"id":"88","title":"Should be more technical","votes":"13","type":"x","order":"2","pct":15.85,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"29","type":"x","order":"3","pct":35.37,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.