-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 --------------------------------------------------------------------------
   Turbolinux Security Advisory TLSA-2005-94
   http://www.turbolinux.co.jp/security/
                                             security-team@turbolinux.co.jp
 --------------------------------------------------------------------------

 Original released date: 03 Oct 2005
 Last revised: 03 Oct 2005

 Package: apache, httpd

 Summary: Two vulnerabilities discovered in apache

 More information:
    Apache is a powerful, full-featured, efficient, and freely-available
    Web server.  Apache is also the most popular Web server on the Internet.

    - The mod_ssl fails to properly enforce client certificates authentication.
    - The byte-range filter in Apache allows remote attackers to cause
    a denial of service (memory consumption) via an HTTP header with a large Range field.

 Impact:
    An attacker may access web documents in a restricted section of a website
    without providing a valid client certificate.
    Allows remote attackers to cause a denial of service of the Apache server.

 Affected Products:
    - Turbolinux 10 Server
    - Turbolinux Home
    - Turbolinux 10 F...
    - Turbolinux 10 Desktop
    - Turbolinux Multimedia
    - Turbolinux Personal
    - Turbolinux 8 Server
    - Turbolinux 8 Workstation
    - Turbolinux 7 Server
    - Turbolinux 7 Workstation

 Solution:
    Please use the turbopkg (zabom) tool to apply the update. 
 ---------------------------------------------
 [Turbolinux 10 Server]
 # turbopkg
 or
 # zabom -u httpd httpd-debug httpd-devel httpd-manual mod_bwshare mod_ssl

 [Turbolinux 10 Desktop, Turbolinux 10 F..., Turbolinux Home,
  Turbolinux Multimedia, Turbolinux Personal]
 # turbopkg
 or
 # zabom -u httpd

 [other]
 # turbopkg
 or
 # zabom update apache apache-devel apache-manual mod_ssl
 ---------------------------------------------


 <Turbolinux 10 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/SRPMS/httpd-2.0.51-15.src.rpm
      6847638 7a426f6b5985bfc5851f18c423647931

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/httpd-2.0.51-15.i586.rpm
      1032286 f19a209690c21a5473194beed6009db2
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/httpd-debug-2.0.51-15.i586.rpm
      3240580 429b255116bca928c7cd853a97d1020b
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/httpd-devel-2.0.51-15.i586.rpm
       223906 0858cbf8007dff97da6fabbd247f5bd4
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/httpd-manual-2.0.51-15.i586.rpm
      1131329 c5dc4690fa25db31df833a3bf1bef771
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/mod_bwshare-2.0.51-15.i586.rpm
        39949 1e6d03cebd04cb9dd11eed86578ac716
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/mod_ssl-2.0.51-15.i586.rpm
        87940 7ed09434b3bd7cab9e37b4015378f892

 <Turbolinux 10 Desktop, Turbolinux 10 F..., Turbolinux Home, Turbolinux Multimedia, Turbolinux Personal>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/SRPMS/httpd-2.0.48-17.src.rpm
      6318836 3b24c76c355fa7e3ea766d979d2bb55a

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/httpd-2.0.48-17.i586.rpm
       892528 37d1e4d78fdf340e6bbb306ea1df8fd4

 <Turbolinux 8 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/apache-1.3.27-33.src.rpm
      3111628 a102c79ee124604354154f171077bae7

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-1.3.27-33.i586.rpm
       502928 25b677b53ec1ce667e8712d806fef1d2
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-devel-1.3.27-33.i586.rpm
        95196 61b6fec7d70393c3f8d46fe384670c86
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-manual-1.3.27-33.i586.rpm
       851445 616c032833ae35ebe3e51578a48d86db
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/mod_ssl-2.8.14-33.i586.rpm
       182701 1adf18e1243710bf0f84d9982996ca5b

 <Turbolinux 8 Workstation>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/apache-1.3.27-33.src.rpm
      3111628 eb032bfbc43ec02b4e183a374967762d

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-1.3.27-33.i586.rpm
       503100 49d195fbbfe449a6abf8741d8359d349
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-devel-1.3.27-33.i586.rpm
        95206 10a47f5998b35e41e881bbf7bea66581
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-manual-1.3.27-33.i586.rpm
       851312 0966a6ed2279c174c7dbd63784bbed99
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/mod_ssl-2.8.14-33.i586.rpm
       182623 110fb8938c73dd58d094b9490e7c81ce

 <Turbolinux 7 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/apache-1.3.27-33.src.rpm
      3111628 15383d66d8ae49038198b85061f05879

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-1.3.27-33.i586.rpm
       489020 c86170b68b484dd10ca5f620b5dd4e5b
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-devel-1.3.27-33.i586.rpm
        95075 b3ead28ae6d1908d76ab88a9e0311076
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-manual-1.3.27-33.i586.rpm
       850436 f3c20386fca42f798814903a17a17b3f
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/mod_ssl-2.8.14-33.i586.rpm
       180268 88ac3991ccd6059d754f7fd5f1c22658

 <Turbolinux 7 Workstation>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/apache-1.3.27-33.src.rpm
      3111628 99236db66d7e468f9c9e41d5e636c36e

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-1.3.27-33.i586.rpm
       489360 a4fa140bc16e0abe1ce4f69a726bfbd2
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-devel-1.3.27-33.i586.rpm
        95238 1431ef5e91ec85b83916e26b9015e806
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-manual-1.3.27-33.i586.rpm
       851470 e5c7b2eb728a501fce3f94b14a111523
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/mod_ssl-2.8.14-33.i586.rpm
       180287 9ce95e401b8cfa6406018a18058b5c79


 References:

 CVE
   [CAN-2005-2700]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700
   [CAN-2005-2728]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2728


 --------------------------------------------------------------------------
 Revision History
    03 Oct 2005 Initial release
 --------------------------------------------------------------------------

 Copyright(C) 2005 Turbolinux, Inc. All rights reserved. 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFDQOy9K0LzjOqIJMwRAs6XAJ4nL5Iol48SjeL6wnSKOKmIAeSfmgCfToAC
72gPYd9+OhQMCru+wnKptJ0=
=EDvw
-----END PGP SIGNATURE-----