• info
• discussion
• exploit
• solution
• references

Apache mod_proxy_ajp Module Incoming Request Body Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Slackware Linux 12.2

• Slackware httpd-2.2.15-i486-1_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ httpd-2.2.15-i486-1_slack12.2.tgz

Debian Linux 5.0 alpha

• Debian apache2-src_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-src_2.2 .9-10+lenny7_all.deb


• Debian apache2_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9-1 0+lenny7_all.deb


• Debian apache2-mpm-prefork_2.2.9-10+lenny7_alpha.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-pre fork_2.2.9-10+lenny7_alpha.deb


• Debian apache2-mpm-itk_2.2.6-02-1+lenny2+b4_alpha.deb
  http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2 -mpm-itk_2.2.6-02-1+lenny2+b4_alpha.deb


• Debian apache2-prefork-dev_2.2.9-10+lenny7_alpha.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork -dev_2.2.9-10+lenny7_alpha.deb


• Debian apache2-mpm-worker_2.2.9-10+lenny7_alpha.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-wor ker_2.2.9-10+lenny7_alpha.deb


• Debian apache2-utils_2.2.9-10+lenny7_alpha.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2 .2.9-10+lenny7_alpha.deb


• Debian apache2-suexec_2.2.9-10+lenny7_alpha.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_ 2.2.9-10+lenny7_alpha.deb


• Debian apache2-suexec-custom_2.2.9-10+lenny7_alpha.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec- custom_2.2.9-10+lenny7_alpha.deb


• Debian apache2-doc_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-doc_2.2 .9-10+lenny7_all.deb


• Debian apache2.2-common_2.2.9-10+lenny7_alpha.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2.2-commo n_2.2.9-10+lenny7_alpha.deb


• Debian apache2-threaded-dev_2.2.9-10+lenny7_alpha.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-threade d-dev_2.2.9-10+lenny7_alpha.deb


• Debian apache2-dbg_2.2.9-10+lenny7_alpha.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2 .9-10+lenny7_alpha.deb


• Debian apache2-mpm-event_2.2.9-10+lenny7_alpha.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-eve nt_2.2.9-10+lenny7_alpha.deb

Debian Linux 5.0 armel

• Debian apache2-prefork-dev_2.2.9-10+lenny7_armel.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork -dev_2.2.9-10+lenny7_armel.deb


• Debian apache2-suexec_2.2.9-10+lenny7_armel.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_ 2.2.9-10+lenny7_armel.deb


• Debian apache2-doc_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-doc_2.2 .9-10+lenny7_all.deb


• Debian apache2-mpm-worker_2.2.9-10+lenny7_armel.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-wor ker_2.2.9-10+lenny7_armel.deb


• Debian apache2-suexec-custom_2.2.9-10+lenny7_armel.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec- custom_2.2.9-10+lenny7_armel.deb


• Debian apache2.2-common_2.2.9-10+lenny7_armel.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2.2-commo n_2.2.9-10+lenny7_armel.deb


• Debian apache2_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9-1 0+lenny7_all.deb


• Debian apache2-mpm-event_2.2.9-10+lenny7_armel.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-eve nt_2.2.9-10+lenny7_armel.deb


• Debian apache2-dbg_2.2.9-10+lenny7_armel.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2 .9-10+lenny7_armel.deb


• Debian apache2-threaded-dev_2.2.9-10+lenny7_armel.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-threade d-dev_2.2.9-10+lenny7_armel.deb


• Debian apache2-src_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-src_2.2 .9-10+lenny7_all.deb


• Debian apache2-mpm-prefork_2.2.9-10+lenny7_armel.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-pre fork_2.2.9-10+lenny7_armel.deb


• Debian apache2-mpm-itk_2.2.6-02-1+lenny2+b3_armel.deb
  http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2 -mpm-itk_2.2.6-02-1+lenny2+b3_armel.deb


• Debian apache2-utils_2.2.9-10+lenny7_armel.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2 .2.9-10+lenny7_armel.deb

Kolab Kolab Groupware Server 2.2 beta3

• Kolab kolab-server-2.2.4
  http://files.kolab.org/server/release/kolab-server-2.2.4/

Debian Linux 5.0 hppa

• Debian apache2-prefork-dev_2.2.9-10+lenny7_hppa.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork -dev_2.2.9-10+lenny7_hppa.deb


• Debian apache2-mpm-event_2.2.9-10+lenny7_hppa.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-eve nt_2.2.9-10+lenny7_hppa.deb


• Debian apache2-mpm-itk_2.2.6-02-1+lenny2+b3_hppa.deb
  http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2 -mpm-itk_2.2.6-02-1+lenny2+b3_hppa.deb


• Debian apache2-utils_2.2.9-10+lenny7_hppa.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2 .2.9-10+lenny7_hppa.deb


• Debian apache2-threaded-dev_2.2.9-10+lenny7_hppa.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-threade d-dev_2.2.9-10+lenny7_hppa.deb


• Debian apache2-doc_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-doc_2.2 .9-10+lenny7_all.deb


• Debian apache2-suexec-custom_2.2.9-10+lenny7_hppa.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec- custom_2.2.9-10+lenny7_hppa.deb


• Debian apache2-mpm-worker_2.2.9-10+lenny7_hppa.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-wor ker_2.2.9-10+lenny7_hppa.deb


• Debian apache2-mpm-prefork_2.2.9-10+lenny7_hppa.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-pre fork_2.2.9-10+lenny7_hppa.deb


• Debian apache2-dbg_2.2.9-10+lenny7_hppa.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2 .9-10+lenny7_hppa.deb


• Debian apache2-src_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-src_2.2 .9-10+lenny7_all.deb


• Debian apache2_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9-1 0+lenny7_all.deb


• Debian apache2.2-common_2.2.9-10+lenny7_hppa.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2.2-commo n_2.2.9-10+lenny7_hppa.deb


• Debian apache2-suexec_2.2.9-10+lenny7_hppa.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_ 2.2.9-10+lenny7_hppa.deb

Debian Linux 5.0 m68k

• Debian apache2-doc_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-doc_2.2 .9-10+lenny7_all.deb


• Debian apache2_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9-1 0+lenny7_all.deb


• Debian apache2-src_2.2.9-10+lenny7_all.deb
  http://security.debian.org/pool/updates/main/a/apache2/apache2-src_2.2 .9-10+lenny7_all.deb

Kolab Kolab Groupware Server 2.2 beta1

• Kolab kolab-server-2.2.4
  http://files.kolab.org/server/release/kolab-server-2.2.4/

Kolab Kolab Groupware Server 2.2 -rc2

• Kolab kolab-server-2.2.4
  http://files.kolab.org/server/release/kolab-server-2.2.4/

Apple Mac OS X Server 10.6

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Kolab Kolab Groupware Server 2.2

• Kolab kolab-server-2.2.4
  http://files.kolab.org/server/release/kolab-server-2.2.4/