-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] apache (SSA:2005-310-04)

New apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1,
10.2, and -current to fix potential security issues:

      * If a request contains both Transfer-Encoding and Content-Length
        headers, remove the Content-Length, mitigating some HTTP Request
        Splitting/Spoofing attacks.

      * Added TraceEnable [on|off|extended] per-server directive to alter
        the behavior of the TRACE method.

It's hard to say how much real-world impact these have, as there's no more
information about that in the announcement.  The original Apache announement
can be read here:

  http://www.apache.org/dist/httpd/Announcement1.3.html

Note that if you use mod_ssl, you will also need a new mod_ssl package.  These
have been provided for the same releases of Slackware.

Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/apache-1.3.34-i486-1.tgz:  Upgraded to apache-1.3.34.
  Fixes this minor security bug:  "If a request contains both Transfer-Encoding
  and Content-Length headers, remove the Content-Length, mitigating some HTTP
  Request Splitting/Spoofing attacks."
  (* Security fix *)
patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz:
  Upgraded to mod_ssl-2.8.25-1.3.34.
+--------------------------+


Where to find the new packages:
+-----------------------------+

Updated packages for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/apache-1.3.34-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/mod_ssl-2.8.25_1.3.34-i386-1.tgz

Updated packages for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/apache-1.3.34-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/mod_ssl-2.8.25_1.3.34-i386-1.tgz

Updated packages for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/apache-1.3.34-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/apache-1.3.34-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/apache-1.3.34-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/apache-1.3.34-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/apache-1.3.34-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/mod_ssl-2.8.25_1.3.34-i486-1.tgz


MD5 signatures:
+-------------+

Slackware 8.1 packages:
5f49a812d8b9456af9e1843776aad2ea  apache-1.3.34-i386-1.tgz
31916dd7d162b10d4e2b200471b90dc9  mod_ssl-2.8.25_1.3.34-i386-1.tgz

Slackware 9.0 packages:
6867b391a99abe9804695e384bb2fc9f  apache-1.3.34-i386-1.tgz
60ef5ab93eff3438688c2aeaefc6b2b9  mod_ssl-2.8.25_1.3.34-i386-1.tgz

Slackware 9.1 packages:
d63354a6b9a54739dcb14d1c6c2e45ef  apache-1.3.34-i486-1.tgz
037056e0241a43d5615fc7358198f56e  mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware 10.0 packages:
ddd47c73ff5ed1fef564ad76907dd8ad  apache-1.3.34-i486-1.tgz
b95bcd1a58011674a725f6cba271a1d1  mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware 10.1 packages:
bce588b7116d9f27b84bd831730e37e8  apache-1.3.34-i486-1.tgz
dc375cdb6c5f4af75cefb4b1a593caf8  mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware 10.2 packages:
2409be9e6daa5046a2f03fa127028903  apache-1.3.34-i486-1.tgz
d771b65a5b384448f3899d4e4aa686b8  mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware -current packages:
2409be9e6daa5046a2f03fa127028903  apache-1.3.34-i486-1.tgz
d771b65a5b384448f3899d4e4aa686b8  mod_ssl-2.8.25_1.3.34-i486-1.tgz


Installation instructions:
+------------------------+


First, stop apache:

# apachectl stop

Then, upgrade the apache package:

# upgradepkg apache-1.3.34-i486-1.tgz

If you use mod_ssl, you'll also need to upgrade that package.  The
upgrade should save the important config files for mod_ssl,
nevertheless it's a good idea to backup any keys/certificates you wish
to save for mod_ssl (in /etc/apache/ssl.*), then upgrade mod_ssl:

# upgradepkg mod_ssl-2.8.25_1.3.34-i486-1.tgz

If necessary, restore any mod_ssl config files.

Finally, restart apache:

# apachectl start

Or, if you use mod_ssl:

# apachectl startssl


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)

iD8DBQFDbmq9akRjwEAQIjMRAsyIAJ9LEBdI+uNh6+T0LecbyHuZP1SQeQCeNxKW
IOJeoc/tdJ/cM0h+xu7J0k8=
=w360
-----END PGP SIGNATURE-----