Apache 1.3.26 and 2.0.39 Released

cliffwoolley writes "The Apache Software Foundation has released new versions of both Apache 1.3 and 2.0. These versions are both security and bug-fix releases. They address and fix the issues noted in CAN-2002-0392 [CERT VU#944335] regarding a vulnerability in the handling of chunked transfer encoding. You can download the new releases here." This of course is for the exploit that we reported yesterday. It is hard to complain about a 24-hour response time for a bug.

Comments

24 is nice...

[jeffy124]

... but it certainly would've been better if ISS had allowed it, or even writeup a proper patch or give the right info on who's vulnerable.

Personally, their argument about not contacting the Apache Foundation because some of them work for Red Hat is complete bullshit, plus the fact that they could've contacted CERT about it instead. CERT would've made sure RH didnt take credit, since that's among ISS's fears, and also would've told them that the issue was known and being worked on.

Re:24 is nice...

[Tony-A]

Apache exploits are pretty hard to come by these days. Miss this one and it will be a long dry spell until anybody finds another one. Like a media feeding frenzy, rationality seems to vanish. Two hour notice and a broken patch, judging from other posts. ISS comes off looking pretty juvenile. There seems to be some indications that Apache was aware of this from another source, so there is some possibility that ISS jumped the gun to avoid being shunted out of the limelight.

Overall Apache comes out smelling like a rose.

"On the Windows and Netware platforms, Apache runs one multithreaded child
process to service requests. The teardown and subsequent setup time to
replace the lost child process presents a significant interruption of
service. As the Windows and Netware ports create a new process and reread
the configuration, rather than fork a child process, this delay is much
more pronounced than on other platforms."
"... Using any multithreaded model, all concurrent requests currently served by the affected child process will be lost."

Sounds like a good reason to run Apache on Linux/BSD/UNIX.
(Well they did claim that Apache 1.3 wasn't really stable on Microsoft Windows;)

Re:24 is nice...

[Tony-A]

We dont know how long Apache/CERT knew about the flaw. Apache probably already had the patch ready to go, just wanted to make sure vendors that redistribute Apache (ie, Red Hat, Suse, etc) were aware of the flaw
The irony is that it is the vendors of Apache for Microsoft Windows who are most in need of the patch. On 32-bit Linux or BSD seems like it's just a pretty lame DoS attempt. I would expect more trouble from Code Red and friends filling up error logs.

Complaints Timescale

[4of12]

It is hard to complain about a 24-hour response time for a bug.

No, it's not:)

Seriously, though, it's a pretty impressive turn around time and should give some credence to those of us making arguments that the support is really there for open source projects like Apache, even though there's no "1-800-HELPME" number nor an expensive maintenance and support agreement.

Re:Complaints Timescale

[4of12]

just type it in a search engine...

What are you asking, man! I'd have to learn how to read, write and think to do that.

Can't I just get a warm fuzzy feeling by buying a large support agreement from Microsoft?

Besides, I'll be among a large herd of IIS users - who could possibly know and want to `sploit me with Code Red?

Most buyers at my site are using fradulent credit card numbers anyway, so if the database gets owned it's not all that big a deal.

24 Hour Response Time

[PeekabooCaribou]

It is hard to complain about a 24-hour response time for a bug.

I think this is the real advantage of OSS. It's people that make Apache, not some group of nameless programmers in a high-rise somewhere. The Apache programmers use Apache on a daily basis, so they stand to gain just as much as the rest of us do by releasing a quick fix. I honestly think they care about making it a good, bug-free product. I put much more trust into the open-source projects than I do for any closed source commercial package.

Win32 MSI Installer Broken

[tyrione]

Downloaded a moment ago and the package is broken so I reverted to downloading the bloated non-msi executable and it works just fine.

24 hour response?

[xswl0931]

Doesn't anyone actually read the articles anymore? Apache was aware of the issue before ISS posted their advisory.

24 Hours - unreasonable and dangerous

[Anonymous Coward]

Givng Apache 24 hours to make a bug fix imposed an unreasonable deadline, and also encouraged the fix to be quick and dirty. Any time code is patched, it could cause other bugs to show, or introduce new ones. Developers need a certain amount of time to do testing once changes are made to make sure they didn't break anything! Kudos to the apache developers for meeting the deadline, but anti-kudos to (i'm not sure who) those imposed it.

Re:24 Hours - unreasonable and dangerous

[buffy]

Givng Apache 24 hours to make a bug fix imposed an unreasonable deadline, and also encouraged the fix to be quick and dirty. Any time code is patched, it could cause other bugs to show, or introduce new ones. Developers need a certain amount of time to do testing once changes are made to make sure they didn't break anything! Kudos to the apache developers for meeting the deadline, but anti-kudos to (i'm not sure who) those imposed it.

You kind-of missed how this went down. Nobody "imposed" a 24-hour window for the bug to be fixed. Had IIS not been a bunch of boneheads and prematurely (as in ejaculation) released information regarding the vulnerability, the programmers involved could've taken a little bit more time to develop the fix, ensuring better quality.

The commendations re: the 24-hour turn around is simply referencing the ability of a lose-knit group of open source programmers to rapidly respond to a bad situation. Had Microsoft been in the same spot (they have been before--people have screwed them, too--and they most certainly will be again) it still would've taken them a lot longer to kick out the fix, and even longer to get it into their distribution channels.

Folks at ISS

[Anonymous Coward]

ISS is full of shit. They have no respect for the way things work. Due to being connected with the security team of my company, I knew about the bug for a few days. And also that the Apache group was working to correct it. But not, the pricks at ISS had to release it with a whopping two hour notice, not only that but they released a broken patch.

And on top of all of that their stock goes up. What a crock of shit.
</rant>

Close your eyes, make the problem go away

[Fastball]

Props to the Apache team for a quick and thorough fix. Now this, THIS is what I call quality control and customer service. This outruns and outguns Microsoft's see no evil, speak no evil policy on security hotfixes. Hands down.

mod_ssl?

[Phroggy]

Anyone know the status of mod_ssl for 1.3.26?

Re:mod_ssl?

[jonabbey]

mod_ssl is baked into the Apache releases 2.0.35 and later, and is _far_ easier to compile and install than the old Apache 1.3 + external mod_ssl was.

Get to Apache 2.0.x when you can.

Re:mod_ssl?

[accessdeniednsp]

Argh..I posted a comment but it was replied to the wrong thread by accident. Crap.. Anyway, here's what I had to say. Hope it helps. (I hope I'm not going to get flamed for anything on this but I probably will).

Me and woolley chatted on irc tonite and i verified his patch [theaimsgroup.com] does indeed work. You will have to manually adjust apache_1.3.26/src/ap/Makefile.tmpl to add the three object files to line 7:

ap_hook.o ap_ctx.o ap_mm.o

The patch will cause a rejection due to modifications between 1.3.24 and 1.3.26 to the file.

The patch applies to apache-1.3.24, btw. And be sure to use mod_ssl-2.8.8-1.3.24 and add --force on the mod_ssl configure line.

Woolley's patch works great.

Re:mod_ssl?

[MadAhab]

Oh, shit, --force. Thanks for posting something actually useful (and you won't get karma for it so just don't start whining ;-)

Actually Useful and Intelligent +0

good job, but the work is not done

[Rubbersoul]

First I must say good work the the apache team, but the must stop and remind everyone the work is not done. Now this patch needs to be applied to all affected systems, now it is time for the SA's and the what not of the world to step up. Lets not forget this fact because even MS releases patchs sooner or later (ok later), but it seems that many boxes stay effected for ever due to bad admining on said MS box(en).

*NIX is in the clear.

[red5]

This advisory is for the multi-threaded version on apache only. So sites running 1.3.x on *nix are unaffected.

Had me worried there for a minute as I admin quite a few of those.

Re:*NIX is in the clear.

[xtremex]

Just updated Apache on my Solaris Box from Source.
Took about about 10 seconds to install. SHutdown apache, make install, start apache.
That was easy!

Re:*NIX is in the clear.

[Micah]

well it takes a bit longer when you have mod_perl, php, and mod_gzip to compile into it. Heading off to do that now....

Re:*NIX is in the clear.

[red5]

Multiply that by like 25 and you have my day.
That and we hack our src/include/httpd.h file to up the HARD_SERVER_LIMIT to 1024.

Re:*NIX is in the clear.

[Tony-A]

Just try that in Microsoft Windows.
Webserver downtime what? About 10 or 15 seconds, I'd guess.

Copy the config.status from the old apache install directory.
Copy modules (I have 'fastcgi' and 'php4') in src/modules from the old directory.
Call config.status, type 'make'.
Make a backup copy of the old httpd
Type 'make install'
'apachectl stop' and 'apachectl start'

Ok, ok, I'm a newbie and still not quite used to the idea of replacing a program while it's still running. Kudos on the ordering of the steps. Murphy's Law might get the better of you, but it will have to work pretty hard to do it.

Re:*NIX is in the clear.

[bill_mcgonigle]

potentially causing a DoS

That's almost the same as 'just fine' with Apache.

I came up with a remarkably simple DoS exploit vs. Apache last year, and the Apache guys basically said, 'well, geez, that sucks, but we'd have to rearchitect Apache to prevent it, so...'. And that's for something that could take down any Apache server with a very lightly distributed DoS.

The way to deal with DoS is with active monitoring; we're never going to have all the possible DoS's fixed in any product.

Re:*NIX is in the clear.

[RobNich]

Although you can replace the binary while it is running, it won't save you time. This will:

apachectl stop; make install; apachectl start;

Debian Woody

[pkplex]

Any idea when the fix will be in the woody packages?

Re:Debian Woody

[Afrosheen]

What the hell is Cockade? Is it gatorade for roosters or what? Nuttier than something I flushed yesterday, this one.

CERT got it slightly wrong?

[Jobe_br]

I'm not sure, since I don't closely follow CERT myself - but an acquaintance e-mailed me the CERT advisory today and I noticed that the 1.3.x version of apache it cites is not 1.3.26 - its 1.3.25:

Upgrade to the latest version

The Apache Software Foundation has released two new versions of Apache that correct this vulnerability. System administrators can prevent the vulnerability from being exploited by upgrading to Apache version 1.3.25 or 2.0.39.

I noticed that a 1.3.25 doesn't actually exist anywhere ... was there a failed release?

Re:CERT got it slightly wrong?

[Builder]

CERT didn't get it wrong, things changed.

The Apache team told CERT that the next 1.3 version would be 1.3.25. This was the plan right up until a couple of hours before release. At this point, 1.3.25 was up for testing, and for some reason (I'm sure it was a good one), 1.3.25 was abandoned and they went to 1.3.26. I'm sure that the changelog will reveal all.

See, I told you so.

[rice_burners_suck]

Need I point out my earlier comment? I'll save you the trouble of looking it up:

I have to say, the Apache web server is quite a high quality piece of work. The fact that an obscure security issue has been found is a good sign that developers and users are on top of things in the constant struggle against remote exploiters.

I am confident that a fix will be available very shortly. Serious sysadmins will have their servers patched sooner than any serious damage takes place. I don't have the same confidence when it comes to Microsoft's products.

I believe it was Dark Helmet who once said, "Evil will always triumph because good is dumb." But in the case of software, it's pretty clear that free will always triumph because commercial is dumb. Honestly, software developed out of a desire to:

• Learn,
• Do good,
• Have fun in the process...

is simply going to be better software than something that's developed out of the runaway greed rampant in the inferior competition.

You are correct.

[red5]

Well at least it's only a DoS.

Looks like it's going to be a long night. :(

PHP now broken?

[Zeekamotay]

Oh sweat. Is this just me, or does 1.3.26 break PHP? I recompiled PHP 4.2.1 from source, but I still get this message when trying to start Apache:

API module structure `php4_module' in file /usr/local/apache/libexec/libphp4.so is garbled - perhaps this is not an Apache module DS
O?

Re:PHP now broken?

[Micah]

odd. I just recompiled everything and:

Server: Apache/1.3.26 (Unix) mod_gzip/1.3.19.1a mod_perl/1.27 PHP/4.2.1

Tested most of my sites and everything seems to work just fine, including PHP sites that use PostgreSQL.

Re:PHP now broken?

[Tony-A]

"PHP now has register_globals turned off by default"
This is to prevent malicious browsers from setting what are supposed to be program variables. info.php as <?phpinfo()?%gt is your friend.

Re:PHP now broken?

[Tony-A]

You are right that PHP was designed for a web-based environment. PHP originally stood for Personal Home Page.
To turn your html into php, just change the .html to .php
Embed your programming in <?php and ?> tags.
All variables have a $ prefix.
Somehow they managed to NOT screw up the language design. PHP4 is good!
Access to APIs such as sql servers is through native calls, rather than attempting some kind of worst common denominator.
Arrays are comparable to Perl Arrays and or Hash, simultaneously. Very handy for result sets which are accessed by name and/or column name, simultaneously.

Same experience here, had to regress PHP

[Akardam]

I regressed to PHP 4.1.2 (the last version that I used sucessfully), and as soon as I did that, it worked like a peach. Perhaps it's a PHP problem; I never used PHP 4.2.x with Apache 1.3.24, so I don't know.

Any other /.ers have this experience?

It's in the Name

[akiy]

It is hard to complain about a 24-hour response time for a bug.

How can you? It's called "A Patchy" server, after all.

Re:24 Hour Response Time - a thought

[q-soe]

Well i think the 24 hour response time is a good thing.. However to play devils advocate for a second - if Microsoft had resolved an issue (i know stop laughing and read on) in 24 hours would it have been posted on here in this manner?? I suspect it would have had a different slant to it...

I only ask this in the light of the fact that ALL software has bugs and issues and exploits but all software eventually gets patched - I find open source more responsive in some cases and worse in others - its not a given that something will get fixed every time faster but on average it is - this is an advantage of open source software for me. The disadvantage of course lies in people who claim open source software never has a bug or exploit at all - all software HAS these things but some softwqare gets fixed faster than others.

Good one to the apache team.

FUD

[Vainglorious Coward]

This of course is for the exploit that we reported yesterday

Um, surely you mean vulnerability ?

That will teach you...

[mikolajl]

...to never work during the weekend.

The weekend is for relaxing ;-)

Not up to industry standards

[return 42]

Geez, how unprofessional. They knew about the vuln, they were working on it, then someone stupidly spilled the beans and they had to pull an all-nighter so their users wouldn't be exposed any longer than necessary.

Anyone knows that a real, professional company would sit on the vuln report for a few weeks, until the finder got fed up and went public with it, then they'd complain about irresponsible disclosure and take two weeks to release a fix.

2.8.9 (apache 1.3.26) out now

[TomatoMan]

It's at modssl.org. Thanks, Ralph!

Makefile is missing

[macdaddy]

Did anyone else notice that the Makefile is missing from the 1.3.26 release? I can't find it anywhere. I was going to upgrade real quick but this rather important piece of the puzzle is missing.

Actually...

[SuiteSisterMary]

It is hard to complain about a 24-hour response time for a bug.

Actually, it's easy. Watch. Gee, I wonder what sort of regression testing they did. Or anything along the lines of QA, other than 'it compiles with only warnings.'

How is that insightful?

[dave-fu]

They original poster probably has very good reasons for using Apache 1.3.
If I take my car to the mechanic for a tune-up, the answer I'm not looking to hear is "forget about the tune-up. why don't you just buy a BMW M1?". In the meantime, I've got an otherwise perfectly fine car just like the original poster likely has a perfectly fine setup (perhaps with apps built and tested under Apache 1.3) and the latest and greatest isn't the answer for them.

Re:How is that insightful?

[jonabbey]

Sure, of course. I did say 'when you can'. And it is far easier to compile and link with a 2.0.x version than it was with 1.3, being as it does come with mod_ssl, and all of the build scripts are integrated.

There is a lot that doesn't yet go so well on 2.0.x, mostly in the form of third party modules that have not been ported and/or certified for use with 2.0.x.

It'll be a better world when they are, though.

Re:24 Hour Response Time - a thought

[Tony-A]

if Microsoft had resolved an issue (i know stop laughing and read on) in 24 hours would it have been posted on here in this manner?? I suspect it would have had a different slant to it
Considering it took something over three days before a search for Code Red on microsoft.com returned anything when microsoft apparently already had a patch for a couple of weeks, methinks the slant would be incredulity.

ALL software has bugs and issues and exploits
Agreed, with the possible exception of some stuff by Donald Knuth.
but all software eventually gets patched
Nope. dBASE5 for DOS has a serious bug which will never be patched. (Under certain conditions, "reading" a file will cause the initial 6 bytes of several other files to be reqritten with stale cached data. Ugly.)

When did Apache 2.0 support Windows 98?

[gsfprez]

I just followed the links, and, if i'm not crazy, you can now run 2.0.x on Windows 98...

Any verification of this?

(its not for me - its for a guy i support... i'm running off of OpenBSD myself)

Re:New mod_ssl?

[JediTrainer]

It's there now. Make sure you reload the page.

I'm already running it in our staging environment, to test it before loading the whole kit-and-caboodle to our production servers.