DSA-1816-1 apache2 -- insufficient security check

Debian Security Advisory

DSA-1816-1 apache2 -- insufficient security check

Date Reported:

16 Jun 2009

Affected Packages:

apache2

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2009-1195.

More information:

It was discovered that the Apache web server did not properly handle the "Options=" parameter to the AllowOverride directive:

• In the stable distribution (lenny), local users could (via .htaccess) enable script execution in Server Side Includes even in configurations where the AllowOverride directive contained only Options=IncludesNoEXEC.

• In the oldstable distribution (etch), local users could (via .htaccess) enable script execution in Server Side Includes and CGI script execution in configurations where the AllowOverride directive contained any "Options=" value.

The oldstable distribution (etch), this problem has been fixed in version 2.2.3-4+etch8.

For the stable distribution (lenny), this problem has been fixed in version 2.2.9-10+lenny3.

For the testing distribution (squeeze) and the unstable distribution (sid), this problem will be fixed in version 2.2.11-6.

This advisory also provides updated apache2-mpm-itk packages which have been recompiled against the new apache2 packages (except for the s390 architecture where updated packages will follow shortly).

We recommend that you upgrade your apache2 packages.

Fixed in:

Debian GNU/Linux 4.0 (etch)

Source:

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4.dsc

http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.3-4+etch8.diff.gz

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01.orig.tar.gz

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4.diff.gz

http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.3.orig.tar.gz

http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.3-4+etch8.dsc

Architecture-independent component:

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-perchild_2.2.3-4+etch8_all.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.3-4+etch8_all.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-src_2.2.3-4+etch8_all.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-doc_2.2.3-4+etch8_all.deb

Alpha:

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch8_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch8_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch8_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch8_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch8_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch8_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch8_alpha.deb

AMD64:

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch8_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch8_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch8_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch8_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch8_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch8_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch8_amd64.deb

ARM:

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch8_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch8_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch8_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch8_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch8_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch8_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch8_arm.deb

HP Precision:

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch8_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch8_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch8_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch8_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch8_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch8_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch8_hppa.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch8_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch8_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch8_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch8_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch8_i386.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch8_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch8_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch8_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch8_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch8_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch8_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch8_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch8_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch8_ia64.deb

Big-endian MIPS:

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch8_mips.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch8_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch8_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch8_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch8_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch8_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch8_mips.deb

Little-endian MIPS:

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch8_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch8_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch8_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch8_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch8_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch8_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch8_mipsel.deb

PowerPC:

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch8_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch8_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch8_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch8_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch8_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch8_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch8_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch8_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch8_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch8_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch8_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch8_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch8_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch8_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.3-4+etch8_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.3-4+etch8_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.3-4+etch8_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.3-4+etch8_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.3-4+etch8_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.3-4+etch8_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.3-01-2+etch4_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.3-4+etch8_sparc.deb

Debian GNU/Linux 5.0 (lenny)

Source:

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1.dsc

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1.diff.gz

http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9-10+lenny3.dsc

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02.orig.tar.gz

http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9-10+lenny3.diff.gz

http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9.orig.tar.gz

Architecture-independent component:

http://security.debian.org/pool/updates/main/a/apache2/apache2_2.2.9-10+lenny3_all.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-src_2.2.9-10+lenny3_all.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-doc_2.2.9-10+lenny3_all.deb

Alpha:

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_alpha.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_alpha.deb

AMD64:

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_amd64.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1_amd64.deb

ARM:

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_arm.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_arm.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1_arm.deb

ARM EABI:

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_armel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_armel.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1_armel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_armel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_armel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_armel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_armel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_armel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_armel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_armel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_armel.deb

HP Precision:

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_hppa.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_hppa.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_i386.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_i386.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_ia64.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_ia64.deb

Big-endian MIPS:

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_mips.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_mips.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_mips.deb

Little-endian MIPS:

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_mipsel.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_mipsel.deb

PowerPC:

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_powerpc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_s390.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/a/apache2/apache2-dbg_2.2.9-10+lenny3_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec-custom_2.2.9-10+lenny3_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-suexec_2.2.9-10+lenny3_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-event_2.2.9-10+lenny3_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-worker_2.2.9-10+lenny3_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2-mpm-itk/apache2-mpm-itk_2.2.6-02-1+lenny1_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2.2-common_2.2.9-10+lenny3_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-prefork-dev_2.2.9-10+lenny3_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-mpm-prefork_2.2.9-10+lenny3_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-utils_2.2.9-10+lenny3_sparc.deb

http://security.debian.org/pool/updates/main/a/apache2/apache2-threaded-dev_2.2.9-10+lenny3_sparc.deb

MD5 checksums of the listed files are available in the original advisory.