From:
[email protected]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------ Debian Security Advisory DSA-1609-1
[email protected] http://www.debian.org/security/ Steve Kemp
July 15, 2008
http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : lighttpd
Vulnerability : various
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2008-0983 CVE-2007-3948
Debian Bug : 434888 466663
Several local/remote vulnerabilities have been discovered in lighttpd,
a fast webserver with minimal memory footprint.
The Common Vulnerabilities and Exposures project identifies the
following problems:
CVE-2008-0983
lighttpd 1.4.18, and possibly other versions before 1.5.0, does not
properly calculate the size of a file descriptor array, which allows
remote attackers to cause a denial of service (crash) via a large number
of connections, which triggers an out-of-bounds access.
CVE-2007-3948
connections.c in lighttpd before 1.4.16 might accept more connections
than the configured maximum, which allows remote attackers to cause a
denial of service (failed assertion) via a large number of connection
attempts.
For the stable distribution (etch), these problems have been fixed in
version 1.4.13-4etch9.
For the unstable distribution (sid), these problems have been fixed in
version 1.4.18-2.
We recommend that you upgrade your lighttpd package.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- -------------------------------
Source archives:
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9.dsc
Size/MD5 checksum: 1106 b9e468fa16bb1874ceef9596827a0aee
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13.orig.tar.gz
Size/MD5 checksum: 793309 3a64323b8482b0e8a6246dbfdb4c39dc
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9.diff.gz
Size/MD5 checksum: 37524 b935ac31122e596b50393b32412c4634
Architecture independent packages:
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1.4.13-4etch9_all.deb
Size/MD5 checksum: 99444 f4da891e3055833d72cedb093ebe961b
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_alpha.deb
Size/MD5 checksum: 65236 07a7c10a1a9e8e5be6591eafdcb2af70
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_alpha.deb
Size/MD5 checksum: 319704 347221cd0521559c703e77a638101378
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_alpha.deb
Size/MD5 checksum: 59970 cd8eebac5cafbfc86a94b7bdec622cdc
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_alpha.deb
Size/MD5 checksum: 71720 2243711e9b479e7201bd075375341570
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_alpha.deb
Size/MD5 checksum: 61748 e082eba9bed47e7d41b97b8c3faf2ab4
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_alpha.deb
Size/MD5 checksum: 64804 2300124052e6cd3d16b5d912771a43d2
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_amd64.deb
Size/MD5 checksum: 70042 f216ba125297f9617e9b93ae5e9c1528
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_amd64.deb
Size/MD5 checksum: 60890 0cf8ebc595c92cf0e5133cfb0fdb45f1
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_amd64.deb
Size/MD5 checksum: 64028 22bef6211d9afd320292721a796671fb
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_amd64.deb
Size/MD5 checksum: 63726 1908fe9c6b35d03ac8cb8ca25bc119a8
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_amd64.deb
Size/MD5 checksum: 59294 a0bc743d9720b97db28764c6c1e0f79c
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_amd64.deb
Size/MD5 checksum: 297536 0de34b9f4ef546ae5f38991f4676143a
arm architecture (ARM)
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_arm.deb
Size/MD5 checksum: 63132 28b693dd3dc65d743e84af5249e6867e
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch9_arm.deb
Size/MD5 checksum: 69696 7c49c8c4dc0ae30526d0ccd02cec9376
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch9_arm.deb
Size/MD5 checksum: 60870 bb8fa82a14b51ddf0c4de1e869755459
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch9_arm.deb
Size/MD5 checksum: 62936 e831e83489ced32abeeae5c4a9b26e01
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch9_arm.deb
Size/MD5 checksum: 286636 77d3c387d79492d0655bf45930ed774a
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_arm.deb
Size/MD5 checksum: 58744 7fe590b4b243a5d33f9328d23c25f037
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch9_hppa.deb
Size/MD5 checksum: 65586 fc9bc390e05808b64c7f3323465f3860
http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch9_hppa.deb
Size/MD5 checksum: 59958 3ba195a79e46a6e896482ffd79121daf
[continued in next message]
--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)