Debian: New pound packages fix multiple vulnerabilities

    Date27 Jan 2006
    CategoryDebian
    3807
    Posted ByJoe Shakespeare
    Two vulnerabilities have been discovered in Pound, a reverse proxy and load balancer for HTTP. The Common Vulnerabilities and Exposures project identifies the following problems:
    - --------------------------------------------------------------------------
    Debian Security Advisory DSA 934-1                     This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                         Moritz Muehlenhoff
    January 9, 2006                         http://www.debian.org/security/faq
    - --------------------------------------------------------------------------
    
    Package        : pound
    Vulnerability  : several
    Problem-Type   : remote
    Debian-specific: no
    CVE ID         : CVE-2005-1391 CVE-2005-3751
    Debian Bug     : 307852
    
    Two vulnerabilities have been discovered in Pound, a reverse proxy and
    load balancer for HTTP. The Common Vulnerabilities and Exposures project
    identifies the following problems:
    
       * CVE-2005-1391:
         Overly long HTTP Host: headers may trigger a buffer overflow in the
         add_port() function, which may lead to the execution of arbitrary
         code.
    
       * CVE-2005-3751:
         HTTP requests with conflicting Content-Length and Transfer-Encoding
         headers could lead to HTTP Request Smuggling Attack, which can be
         exploited to bypass packet filters or poison web caches.
    
    The old stable distribution (woody) does not contain pound packages.
    
    For the stable distribution (sarge) these problems have been fixed in
    version 1.8.2-1sarge1
    
    For the unstable distribution (sid) these problems have been fixed in
    version 1.9.4-1
    
    We recommend that you upgrade your pound package.
    
    
    Upgrade Instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 3.1 alias sarge
    - --------------------------------
    
      Source archives:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1.dsc
          Size/MD5 checksum:      643 334d91f8800581281ab9c8bad5bbdbf4
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1.diff.gz
          Size/MD5 checksum:    13242 9e404c899bfd5409610ed5f14345d341
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2.orig.tar.gz
          Size/MD5 checksum:   140455 c9b0793bb4d57be2270093d79b13c019
    
      Alpha architecture:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1_alpha.deb
          Size/MD5 checksum:    73284 0458e20d63c3f5f5788afe7564a385da
    
      AMD64 architecture:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1_amd64.deb
          Size/MD5 checksum:    68652 01ae48ac313a8e533f32eec2f6f7a62f
    
      ARM architecture:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1_arm.deb
          Size/MD5 checksum:    69072 73b7eb49a74c8a5ff6a8015cf9a0e45d
    
      Intel IA-32 architecture:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1_i386.deb
          Size/MD5 checksum:    68684 da43b8adaf115680c72d8f5dce9bc99f
    
      Intel IA-64 architecture:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1_ia64.deb
          Size/MD5 checksum:    80756 ec6d043c70e50e8ba492ef6a73a4cc18
    
      HP Precision architecture:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1_hppa.deb
          Size/MD5 checksum:    70288 22fa75150b2253640667714cf6197567
    
      Motorola 680x0 architecture:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1_m68k.deb
          Size/MD5 checksum:    65138 1de5e7b4492a51900e13f9a0f5decd18
    
      Big endian MIPS architecture:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1_mips.deb
          Size/MD5 checksum:    68586 3eb28320dc9229ee8cc08d2967e8ee9b
    
      Little endian MIPS architecture:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1_mipsel.deb
          Size/MD5 checksum:    68654 510807d792c96e8cc43edf72fcdcc243
    
      PowerPC architecture:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1_powerpc.deb
          Size/MD5 checksum:    69218 d03e4cc71f99c2017a417cf8f073438c
    
      IBM S/390 architecture:
    
        http://security.debian.org/pool/updates/main/p/pound/pound_1.8.2-1sarge1_s390.deb
          Size/MD5 checksum:    69268 dac44abdc98358ccc66c2c3f41bd0965
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"67","type":"x","order":"1","pct":57.76,"resources":[]},{"id":"88","title":"Should be more technical","votes":"15","type":"x","order":"2","pct":12.93,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"34","type":"x","order":"3","pct":29.31,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.