apache (SSA:2005-310-04)

New apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix potential security issues:

* If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks.

* Added TraceEnable [on|off|extended] per-server directive to alter the behavior of the TRACE method.

It's hard to say how much real-world impact these have, as there's no more information about that in the announcement. The original Apache nnounement can be read here:

http://www.apache.org/dist/httpd/Announcement1.3.html

Note that if you use mod_ssl, you will also need a new mod_ssl package. These have been provided for the same releases of Slackware.

Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/apache-1.3.34-i486-1.tgz: Upgraded to apache-1.3.34.
Fixes this minor security bug: "If a request contains both Transfer-Encoding
and Content-Length headers, remove the Content-Length, mitigating some HTTP
Request Splitting/Spoofing attacks."
(* Security fix *)
patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz:
Upgraded to mod_ssl-2.8.25-1.3.34.
+--------------------------+


Where to find the new packages:
+-----------------------------+

Updated packages for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/apache-1.3.34-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/mod_ssl-2.8.25_1.3.34-i386-1.tgz

Updated packages for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/apache-1.3.34-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/mod_ssl-2.8.25_1.3.34-i386-1.tgz

Updated packages for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/apache-1.3.34-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/apache-1.3.34-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/apache-1.3.34-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/apache-1.3.34-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/mod_ssl-2.8.25_1.3.34-i486-1.tgz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/apache-1.3.34-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/mod_ssl-2.8.25_1.3.34-i486-1.tgz


MD5 signatures:
+-------------+

Slackware 8.1 packages:
5f49a812d8b9456af9e1843776aad2ea apache-1.3.34-i386-1.tgz
31916dd7d162b10d4e2b200471b90dc9 mod_ssl-2.8.25_1.3.34-i386-1.tgz

Slackware 9.0 packages:
6867b391a99abe9804695e384bb2fc9f apache-1.3.34-i386-1.tgz
60ef5ab93eff3438688c2aeaefc6b2b9 mod_ssl-2.8.25_1.3.34-i386-1.tgz

Slackware 9.1 packages:
d63354a6b9a54739dcb14d1c6c2e45ef apache-1.3.34-i486-1.tgz
037056e0241a43d5615fc7358198f56e mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware 10.0 packages:
ddd47c73ff5ed1fef564ad76907dd8ad apache-1.3.34-i486-1.tgz
b95bcd1a58011674a725f6cba271a1d1 mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware 10.1 packages:
bce588b7116d9f27b84bd831730e37e8 apache-1.3.34-i486-1.tgz
dc375cdb6c5f4af75cefb4b1a593caf8 mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware 10.2 packages:
2409be9e6daa5046a2f03fa127028903 apache-1.3.34-i486-1.tgz
d771b65a5b384448f3899d4e4aa686b8 mod_ssl-2.8.25_1.3.34-i486-1.tgz

Slackware -current packages:
2409be9e6daa5046a2f03fa127028903 apache-1.3.34-i486-1.tgz
d771b65a5b384448f3899d4e4aa686b8 mod_ssl-2.8.25_1.3.34-i486-1.tgz


Installation instructions:
+------------------------+


First, stop apache:

# apachectl stop

Then, upgrade the apache package:

# upgradepkg apache-1.3.34-i486-1.tgz

If you use mod_ssl, you'll also need to upgrade that package. The
upgrade should save the important config files for mod_ssl,
nevertheless it's a good idea to backup any keys/certificates you wish
to save for mod_ssl (in /etc/apache/ssl.*), then upgrade mod_ssl:

# upgradepkg mod_ssl-2.8.25_1.3.34-i486-1.tgz

If necessary, restore any mod_ssl config files.

Finally, restart apache:

# apachectl start

Or, if you use mod_ssl:

# apachectl startssl


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com