Synopsis

Important: httpd security update

Type/Severity

Security Advisory: Important

Topic

Updated httpd packages that fix one security issue are now available for
Red Hat Enterprise Linux 5.3 Long Life, 5.6 Extended Update Support, and
6.0 Extended Update Support.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

The Apache HTTP Server is a popular web server.

A flaw was found in the way the Apache HTTP Server handled Range HTTP
headers. A remote attacker could use this flaw to cause httpd to use an
excessive amount of memory and CPU time via HTTP requests with a
specially-crafted Range header. (CVE-2011-3192)

All httpd users should upgrade to these updated packages, which contain a
backported patch to correct this issue. After installing the updated
packages, the httpd daemon must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server - Extended Update Support 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 i386
• Red Hat Enterprise Linux Server - AUS 5.6 x86_64
• Red Hat Enterprise Linux Server - AUS 5.6 ia64
• Red Hat Enterprise Linux Server - AUS 5.6 i386
• Red Hat Enterprise Linux Server - AUS 5.3 x86_64
• Red Hat Enterprise Linux Server - AUS 5.3 ia64
• Red Hat Enterprise Linux Server - AUS 5.3 i386
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6 s390x
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6 ppc

Fixes

• BZ - 732928 - CVE-2011-3192 httpd: multiple ranges DoS

CVEs

• CVE-2011-3192

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server - Extended Update Support 5.6

SRPM
httpd-2.2.3-45.el5_6.2.src.rpm	SHA-256: d4b78a0eaf9098cf335130abb4c6c7dce1d7571df21ff8ce8a37ad12d915b24f
x86_64
httpd-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: a777315e103dd37bfaf92053159cca4147c9dbb8abfaa37400d65b8a80bd5416
httpd-devel-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 09394d979a237a181ddd13f4767f6f7f8f5014b40e573e24652025484213c225
httpd-devel-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: c51ce58a90203ee714c3ea7193af2c6e143f9b93c7c3c41ba166b8ed29ec292c
httpd-manual-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: 593b4a1b26ab6c6e3870049eb3a95031a4d3a1886dd6d137c182fea5e8cc54a0
mod_ssl-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: 35ebba0e03d53a747f88e0246c7de77693ede3a37347f265cc05fab14a39c089
ia64
httpd-2.2.3-45.el5_6.2.ia64.rpm	SHA-256: 249a31be0e9a68be65c4e47cc24907f3f520c6dfc5217bb26c20e34c54c2f06f
httpd-devel-2.2.3-45.el5_6.2.ia64.rpm	SHA-256: d7a6a22f6d616d099fc1e3203365ffc8eed91cd35ffbe257e78c4497db79bc1f
httpd-manual-2.2.3-45.el5_6.2.ia64.rpm	SHA-256: 71298af8c9148018ebbbbf19810e9051ebec056bc4cc4010898dd2bdca544164
mod_ssl-2.2.3-45.el5_6.2.ia64.rpm	SHA-256: d823d4a8cdd3c16f7f02c8ffc540099b0d94f9ef32d34c941337941f37fc6997
i386
httpd-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 544b2aef737473317a738c1ad170dbd587fd17213f17f048d8374fb5eec38867
httpd-devel-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 09394d979a237a181ddd13f4767f6f7f8f5014b40e573e24652025484213c225
httpd-manual-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 604bf5f2bd6883144c1fbe3c5ee8021a73627f8fae637f1c8940132ea1e4a896
mod_ssl-2.2.3-45.el5_6.2.i386.rpm	SHA-256: b6759df9f2f5f7c9b07833e619f4460e13aaaefeb78f17f23b022ae22b428738

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6

SRPM
httpd-2.2.3-45.el5_6.2.src.rpm	SHA-256: d4b78a0eaf9098cf335130abb4c6c7dce1d7571df21ff8ce8a37ad12d915b24f
s390x
httpd-2.2.3-45.el5_6.2.s390x.rpm	SHA-256: e779636ad1b359ad2cc29b5d900feeb372efed7c70a3ae446d0096835359761b
httpd-devel-2.2.3-45.el5_6.2.s390.rpm	SHA-256: 271ed5d44b70ca3387956887fa2cafe482caac30a4ea1e8ef73dac2447800a6f
httpd-devel-2.2.3-45.el5_6.2.s390x.rpm	SHA-256: 5d412553a42d881e063a306ab6fe34991c093b6ac0bc7bb82074017f93f09269
httpd-manual-2.2.3-45.el5_6.2.s390x.rpm	SHA-256: 54763d5ed601c18554368946de65825ac7de7b7c5a4e0ade250f7bc6f57d7154
mod_ssl-2.2.3-45.el5_6.2.s390x.rpm	SHA-256: 37df253fe95c5a7a05877e0d0f20026bb77460637264c1d4d288cb57c181223a

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6

SRPM
httpd-2.2.3-45.el5_6.2.src.rpm	SHA-256: d4b78a0eaf9098cf335130abb4c6c7dce1d7571df21ff8ce8a37ad12d915b24f
ppc
httpd-2.2.3-45.el5_6.2.ppc.rpm	SHA-256: f57c2a8c18fc1d0a6ce27f672929e5795e4b80939af7fe3901a4dc1cea5ea433
httpd-devel-2.2.3-45.el5_6.2.ppc.rpm	SHA-256: 92172f066cb68b162391a5118531ba35b1a0dfbfcf76f776e7b09a7ec6f51edd
httpd-devel-2.2.3-45.el5_6.2.ppc64.rpm	SHA-256: b2c45e977e89dcbde7729cebd4bebceddf9a39b0c3ebbb2290e81933df95a555
httpd-manual-2.2.3-45.el5_6.2.ppc.rpm	SHA-256: eff6a89119fa2fc78cce275347d4f4bb470bc91ec0599c454c23fb6e4ef4c1e8
mod_ssl-2.2.3-45.el5_6.2.ppc.rpm	SHA-256: 2c017623b1fcb33cb8213b43b1d51038f786747a04c7a42d0aa1f5cb59813e8f

Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6

SRPM
httpd-2.2.3-45.el5_6.2.src.rpm	SHA-256: d4b78a0eaf9098cf335130abb4c6c7dce1d7571df21ff8ce8a37ad12d915b24f
x86_64
httpd-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: a777315e103dd37bfaf92053159cca4147c9dbb8abfaa37400d65b8a80bd5416
httpd-devel-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 09394d979a237a181ddd13f4767f6f7f8f5014b40e573e24652025484213c225
httpd-devel-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: c51ce58a90203ee714c3ea7193af2c6e143f9b93c7c3c41ba166b8ed29ec292c
httpd-manual-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: 593b4a1b26ab6c6e3870049eb3a95031a4d3a1886dd6d137c182fea5e8cc54a0
mod_ssl-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: 35ebba0e03d53a747f88e0246c7de77693ede3a37347f265cc05fab14a39c089
i386
httpd-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 544b2aef737473317a738c1ad170dbd587fd17213f17f048d8374fb5eec38867
httpd-devel-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 09394d979a237a181ddd13f4767f6f7f8f5014b40e573e24652025484213c225
httpd-manual-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 604bf5f2bd6883144c1fbe3c5ee8021a73627f8fae637f1c8940132ea1e4a896
mod_ssl-2.2.3-45.el5_6.2.i386.rpm	SHA-256: b6759df9f2f5f7c9b07833e619f4460e13aaaefeb78f17f23b022ae22b428738

Red Hat Enterprise Linux Server - AUS 5.6

SRPM
httpd-2.2.3-45.el5_6.2.src.rpm	SHA-256: d4b78a0eaf9098cf335130abb4c6c7dce1d7571df21ff8ce8a37ad12d915b24f
x86_64
httpd-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: a777315e103dd37bfaf92053159cca4147c9dbb8abfaa37400d65b8a80bd5416
httpd-devel-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 09394d979a237a181ddd13f4767f6f7f8f5014b40e573e24652025484213c225
httpd-devel-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: c51ce58a90203ee714c3ea7193af2c6e143f9b93c7c3c41ba166b8ed29ec292c
httpd-manual-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: 593b4a1b26ab6c6e3870049eb3a95031a4d3a1886dd6d137c182fea5e8cc54a0
mod_ssl-2.2.3-45.el5_6.2.x86_64.rpm	SHA-256: 35ebba0e03d53a747f88e0246c7de77693ede3a37347f265cc05fab14a39c089
ia64
httpd-2.2.3-45.el5_6.2.ia64.rpm	SHA-256: 249a31be0e9a68be65c4e47cc24907f3f520c6dfc5217bb26c20e34c54c2f06f
httpd-devel-2.2.3-45.el5_6.2.ia64.rpm	SHA-256: d7a6a22f6d616d099fc1e3203365ffc8eed91cd35ffbe257e78c4497db79bc1f
httpd-manual-2.2.3-45.el5_6.2.ia64.rpm	SHA-256: 71298af8c9148018ebbbbf19810e9051ebec056bc4cc4010898dd2bdca544164
mod_ssl-2.2.3-45.el5_6.2.ia64.rpm	SHA-256: d823d4a8cdd3c16f7f02c8ffc540099b0d94f9ef32d34c941337941f37fc6997
i386
httpd-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 544b2aef737473317a738c1ad170dbd587fd17213f17f048d8374fb5eec38867
httpd-devel-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 09394d979a237a181ddd13f4767f6f7f8f5014b40e573e24652025484213c225
httpd-manual-2.2.3-45.el5_6.2.i386.rpm	SHA-256: 604bf5f2bd6883144c1fbe3c5ee8021a73627f8fae637f1c8940132ea1e4a896
mod_ssl-2.2.3-45.el5_6.2.i386.rpm	SHA-256: b6759df9f2f5f7c9b07833e619f4460e13aaaefeb78f17f23b022ae22b428738