[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#322607: marked as done (SECURITY: HTTP proxy responses with both Transfer-Encoding and Content-Length headers (CAN-2005-2088))

Your message dated Fri, 16 Dec 2005 21:19:02 -0800
with message-id <E1EnUTG-0007mI-Gq@spohr.debian.org>
and subject line Bug#322607: fixed in apache 1.3.33-6sarge1
has caused the attached Bug report to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere.  Please contact me immediately.)

Debian bug tracking system administrator
(administrator, Debian Bugs database)

Received: (at submit) by bugs.debian.org; 28 Jun 2005 22:49:46 +0000
>From jmm@inutil.org Tue Jun 28 15:49:44 2005
Return-path: <jmm@inutil.org>
Received: from inutil.org (vserver151.vserver151.serverflex.de) [] 
	by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 1DnOtj-0005fj-00; Tue, 28 Jun 2005 15:49:43 -0700
Received: from dsl-082-082-137-197.arcor-ip.net ([] helo=localhost.localdomain)
	by vserver151.vserver151.serverflex.de with esmtpsa (TLS-1.0:RSA_AES_256_CBC_SHA:32)
	(Exim 4.50)
	id 1DnOo7-0006DV-N0
	for submit@bugs.debian.org; Wed, 29 Jun 2005 00:43:55 +0200
Received: from jmm by localhost.localdomain with local (Exim 4.51)
	id 1DnOtX-0001i1-IX; Wed, 29 Jun 2005 00:49:31 +0200
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Moritz Muehlenhoff <jmm@inutil.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: apache2: Security issues in HTTP proxy responses with both Transfer-Encoding
 and Content-Length headers
X-Mailer: reportbug 3.15
Date: Wed, 29 Jun 2005 00:49:31 +0200
X-Debbugs-Cc: security@debian.org
Message-Id: <E1DnOtX-0001i1-IX@localhost.localdomain>
X-SA-Exim-Mail-From: jmm@inutil.org
X-SA-Exim-Scanned: No (on vserver151.vserver151.serverflex.de); SAEximRunCond expanded to false
Delivered-To: submit@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 
	(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-11.0 required=4.0 tests=BAYES_00,HAS_PACKAGE,
	X_DEBBUGS_CC autolearn=ham version=2.60-bugs.debian.org_2005_01_02

Package: apache2
Severity: grave
Tags: security
Justification: user security hole

Latest 2.1.6-alpha fixes a security in the proxy HTTP code:

| The 2.1.6-alpha release addresses a security vulnerability present
| in all previous 2.x versions.  This fault did not affect Apache 1.3.x
| (which did not proxy keepalives or chunked transfer encoding);

|    Proxy HTTP: If a response contains both Transfer-Encoding
|    and a Content-Length, remove the Content-Length to eliminate
|    an HTTP Request Smuggling vulnerability and don't reuse the
|    connection, stopping some HTTP Request Spoofing attacks.


-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12-rc5
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15@euro (charmap=ISO-8859-15)

Received: (at 322607-close) by bugs.debian.org; 17 Dec 2005 05:21:36 +0000
>From katie@ftp-master.debian.org Fri Dec 16 21:21:36 2005
Return-path: <katie@ftp-master.debian.org>
Received: from katie by spohr.debian.org with local (Exim 4.50)
	id 1EnUTG-0007mI-Gq; Fri, 16 Dec 2005 21:19:02 -0800
From: Adam Conrad <adconrad@0c3.net>
To: 322607-close@bugs.debian.org
X-Katie: $Revision: 1.17 $
Subject: Bug#322607: fixed in apache 1.3.33-6sarge1
Message-Id: <E1EnUTG-0007mI-Gq@spohr.debian.org>
Sender: Archive Administrator <katie@ftp-master.debian.org>
Date: Fri, 16 Dec 2005 21:19:02 -0800
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 
	(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER 
	autolearn=no version=2.60-bugs.debian.org_2005_01_02

Source: apache
Source-Version: 1.3.33-6sarge1

We believe that the bug you reported is fixed in the latest version of
apache, which is due to be installed in the Debian FTP archive:

  to pool/main/a/apache/apache-common_1.3.33-6sarge1_i386.deb
  to pool/main/a/apache/apache-dbg_1.3.33-6sarge1_i386.deb
  to pool/main/a/apache/apache-dev_1.3.33-6sarge1_all.deb
  to pool/main/a/apache/apache-doc_1.3.33-6sarge1_all.deb
  to pool/main/a/apache/apache-perl_1.3.33-6sarge1_i386.deb
  to pool/main/a/apache/apache-ssl_1.3.33-6sarge1_i386.deb
  to pool/main/a/apache/apache-utils_1.3.33-6sarge1_all.deb
  to pool/main/a/apache/apache_1.3.33-6sarge1.diff.gz
  to pool/main/a/apache/apache_1.3.33-6sarge1.dsc
  to pool/main/a/apache/apache_1.3.33-6sarge1_i386.deb
  to pool/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge1_i386.deb

A summary of the changes between this version and the previous one is

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 322607@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
Adam Conrad <adconrad@0c3.net> (supplier of updated apache package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

Hash: SHA1

Format: 1.7
Date: Tue,  6 Sep 2005 23:02:02 +1000
Source: apache
Binary: apache-dev apache-common apache-doc apache-utils apache apache-dbg apache-perl libapache-mod-perl apache-ssl
Architecture: source i386 all
Version: 1.3.33-6sarge1
Distribution: stable-security
Urgency: high
Maintainer: Debian Apache Maintainers <debian-apache@lists.debian.org>
Changed-By: Adam Conrad <adconrad@0c3.net>
 apache     - versatile, high-performance HTTP server
 apache-common - support files for all Apache webservers
 apache-dbg - debug versions of the Apache webservers
 apache-dev - development kit for the Apache webserver
 apache-doc - documentation for the Apache webserver
 apache-perl - versatile, high-performance HTTP server with Perl support
 apache-ssl - versatile, high-performance HTTP server with SSL support
 apache-utils - utility programs for webservers (transitional package)
 libapache-mod-perl - integration of perl with the Apache web server
Closes: 322607
 apache (1.3.33-6sarge1) stable-security; urgency=high
   * Add 906_content_length_CAN-2005-2088, resolving an issue in mod_proxy
     where, when a response contains both Transfer-Encoding and Content-Length
     headers, the connection can be used for HTTP request smuggling and HTTP
     request spoofing attacks; see CAN-2005-2088 (closes: #322607)
 1fd30bda6f8ced16f68a75b42062e719 1119 web optional apache_1.3.33-6sarge1.dsc
 1a34f13302878a8713a2ac760d9b6da8 3105683 web optional apache_1.3.33.orig.tar.gz
 9b04027dc8af9fc5c19bef5304d6d1a6 369073 web optional apache_1.3.33-6sarge1.diff.gz
 53df3e1f7e47375c957673ff49649ee2 1189326 doc optional apache-doc_1.3.33-6sarge1_all.deb
 2690e824569ca7d3b20c22697fff83ac 331258 devel extra apache-dev_1.3.33-6sarge1_all.deb
 1a9af803b7bb9ee718c8d2463157c73d 212030 web optional apache-utils_1.3.33-6sarge1_all.deb
 d1fb460ac66b9c279bb973962c6b37a6 385394 web optional apache_1.3.33-6sarge1_i386.deb
 fa4e8d3d4c725d0145c78b3f782566d3 492748 web optional apache-ssl_1.3.33-6sarge1_i386.deb
 49cff4c1bc76b51806afe487c0a93fd5 504894 web optional apache-perl_1.3.33-6sarge1_i386.deb
 d39bd56c23b083feeb2d30c1582ac091 9128930 devel extra apache-dbg_1.3.33-6sarge1_i386.deb
 ad852939fd0e97aa35f731e506888eca 844800 web optional apache-common_1.3.33-6sarge1_i386.deb
 0ad21611cc1f3e24e4b51b0b0a76b1bf 485896 web optional libapache-mod-perl_1.29.0.3-6sarge1_i386.deb

Version: GnuPG v1.4.1 (GNU/Linux)


Reply to: