Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Slackware: 2011-252-01 Critical: Httpd Denial Of Service Issue

slackware
Calendar Grey September 9, 2011
Scroller Slackware
Enhance Slackware's httpd to resolve a DoS vulnerability with the latest packages. Keep your system safe and current!
Not long ago, httpd package updates were issued to clamp down on a denial of service bug that's seen some action in the wild

Summary

Here are the details from the Slackware 13.37 ChangeLog: patches/packages/httpd-2.2.20-i486-1_slack13.37.txz: Upgraded. SECURITY: CVE-2011-3192 (cve.mitre.org) core: Fix handling of byte-range requests to use less memory, to avoid denial of service. If the sum of all ranges in a request is larger than the original file, ignore the ranges and send the complete file. PR 51714. [Stefan Fritsch, Jim Jagielski, Ruediger Pluem, Eric Covener] For more information, see: https://www.cve.org/CVERecord?id=CVE-2011-3192 (* Security fix *)

Topics%20covered

Topics Covered

security advisory denial of service critical package update security fix httpd slackware

Where Find New Packages

Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you.

Updated package for Slackware 12.1:
Updated package for Slackware 12.2:
Updated package for Slackware 13.0:
Updated package for Slackware x86_64 13.0:
Updated package for Slackware 13.1:
Updated package for Slackware x86_64 13.1:
Updated package for Slackware 13.37:
Updated package for Slackware x86_64 13.37:
Updated package for Slackware -current:
Updated package for Slackware x86_64 -current:

MD5 Signatures

Slackware 12.0 package: 1c5d2923bf5ee56ea5b26a14f4bef750 httpd-2.2.20-i486-1_slack12.0.tgz
Slackware 12.1 package: 1afa27da8d2d897f871fb5fe91832f04 httpd-2.2.20-i486-1_slack12.1.tgz
Slackware 12.2 package: 883d978f2eb2fa09e0094096860995ef httpd-2.2.20-i486-1_slack12.2.tgz
Slackware 13.0 package: db6935f7ce78acd0cf63bfed97497334 httpd-2.2.20-i486-1_slack13.0.txz
Slackware x86_64 13.0 package: 8c976a586a885b33c910c71a4cb655c9 httpd-2.2.20-x86_64-1_slack13.0.txz
Slackware 13.1 package: eab2ada5def61d8734a80e887b10edc7 httpd-2.2.20-i486-1_slack13.1.txz
Slackware x86_64 13.1 package: 378da86cc706426c68cb3404bceb146c httpd-2.2.20-x86_64-1_slack13.1.txz
Slackware 13.37 package: ac06dfbefebd419d7bebf3f18ddd1304 httpd-2.2.20-i486-1_slack13.37.txz
Slackware x86_64 13.37 package: c650ee26fde72c7e6524784fa63ff8b8 httpd-2.2.20-x86_64-1_slack13.37.txz
Slackware -current package: 7afbbaae7ed7605620ad76dc9ae1146b n/httpd-2.2.20-i486-1.txz
Slackware x86_64 -current package: 5ef29bd575c49645496cbfc4fe657c84 n/httpd-2.2.20-x86_64-1.txz

Severity
critical
Lowest
Low
Medium
High
Critical

Topics%20covered

Topics Covered

security advisory denial of service critical package update security fix httpd slackware

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the package as root: # upgradepkg httpd-2.2.20-i486-1_slack13.37.txz Then, restart the httpd daemon.