-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2011.1273
                         lighttpd security update
                             21 December 2011

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           lighttpd
Publisher:         Debian
Operating System:  Debian GNU/Linux 5
                   Debian GNU/Linux 6
                   UNIX variants (UNIX, Linux, OSX)
                   Windows
Impact/Access:     Access Privileged Data -- Remote with User Interaction
                   Denial of Service      -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2011-4362 CVE-2011-3389 

Reference:         ASB-2011.0120
                   ASB-2011.0092
                   ASB-2011.0071.2
                   ESB-2011.1196
                   ESB-2011.1186
                   ESB-2011.1041

Original Bulletin: 
   http://www.debian.org/security/2011/dsa-2368

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Debian. It is recommended that administrators 
         running lighttpd check for an updated version of the software for 
         their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------------
Debian Security Advisory DSA-2368-1                     security@debian.org
http://www.debian.org/security/                                  Nico Golde
Dec 20th, 2011                           http://www.debian.org/security/faq
- - ---------------------------------------------------------------------------

Package        : lighttpd
Vulnerability  : multiple
Problem type   : remote
Debian-specific: no
Debian bug     : 652726
CVE IDs        : CVE-2011-4362 CVE-2011-3389

Several vulnerabilities have been discovered in lighttpd, a small and fast
webserver with minimal memory footprint.

CVE-2011-4362

  Xi Wang discovered that the base64 decoding routine which is used to
  decode user input during an HTTP authentication, suffers of a signedness
  issue when processing user input.  As a result it is possible to force
  lighttpd to perform an out-of-bounds read which results in Denial of
  Service conditions.

CVE-2011-3389

  When using CBC ciphers on an SSL enabled virtual host to communicate with
  certain client, a so called "BEAST" attack allows man-in-the-middle
  attackers to obtain plaintext HTTP traffic via a blockwise
  chosen-boundary attack (BCBA) on an HTTPS session.  Technically this is
  no lighttpd vulnerability.  However, lighttpd offers a workaround to
  mitigate this problem by providing a possibility to disable CBC ciphers.

  This updates includes this option by default. System administrators
  are advised to read the NEWS file of this update (as this may break older
  clients).


For the oldstable distribution (lenny), this problem has been fixed in
version 1.4.19+lenny3.

For the stable distribution (squeeze), this problem has been fixed in
version 1.4.28-2+squeeze1.

For the testing distribution (squeeze), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 1.4.30-1.


We recommend that you upgrade your lighttpd packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk7xJ1MACgkQHYflSXNkfP+N5ACgtImneTJSdyEiCLnWTFA0uxzz
qP0An07LJwL5K3NmrMRfKeCVpigpn1zR
=QU3k
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBTvE3aO4yVqjM2NGpAQJSfA/+KRlSMGH53rqaer6Gt+ZQPjQHpNSRIrET
qSBD9U/0qkB8G0Mj4jdl6B6GG65QZnPT636IAom4drcKeU7SWz8906EAh/bcsgZE
gHeD9GEg/dr7rmjrBrx4oePWiw0+i1AtLmBOQfkrL12MUZFV5ARIsLZkQ95brMoL
muucExEIVEv5xKEjDdPWBvQmzxKDjlTSI9Y2fNX/oDj2dYMTpmWdpn/IqPu8uw9q
T3AhHUZxerMVlrN+eZ+u1oak2i2uhS5D/wDPSpCp0JNplAkcc0OL3lTyHEkES089
tuUxttFTUNazv+R8dIt6XqDBXT1eC8bROdidwLc5oV6LIWXRi7QA2ITJ6tVoqZnp
LvPi06ytur6422i0S1qUrogPrmN3LmkuogAXlpNOKyJVd1AKgjsgdEbQ25fKntyn
0lJh+9sPqS1rErhtgML2x+/1CQ3H+l0GcTIUvkmIEsK22iqf2WT3Vb5WSliCUifY
75E8oPkdecOs5iv3Wte1OeB+lPx1SK0vmmo/65SDllfxdT2muWfWKer3tLxl4kre
bfRmuZ7V3lNVGNsWBnFEns2F+WfIqoVL/D/Z9teAmHqR0LLb74YK0vwTyh5W0nUD
dLcBdaUiMU/M8G/7hOE4CjzH7wnrpcbfd7aSYC6mT2CpFXMaZWe6h4bqE8HUYJjo
7WBzE/ozCDM=
=5fNY
-----END PGP SIGNATURE-----