Slashdot Mirror
SecurityFocus Updates 2 Apache Vulnerabilities
michael path writes "SecurityFocus released two updated Apache vulnerabilities, one affecting 2.0.x (a DOS vulnerability), the other affecting both the 1.3.x and 2.0.x revisions (a buffer overflow). IBM HTTP Server is also affected by these vulnerabilities in similar version numbers."
from my logs [Mon Apr 12 16:29:53 2004] [error] [client 64.229.154.62] request failed: URI too long
from the articleFrom my machine $ httpd -v
Server version: Apache/1.3.29 (Unix)
Server built: Nov 3 2003 19:54:39
For those of you running OS X who don't want to scroll through the three thousand lines of version information in the securityfocus.com link, if you're running 10.3.3 you should be fine, because 10.3.3 uses Apache 1.3.29.
--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft
it doesn't say whether httpd-2.0.49 is or is not vulnerable.
These are both rather old.
0 y -13
If you want more complete information about
apache security issues, a better source is
http://www.apacheweek.com/features/security-2
and
http://www.apacheweek.com/features/securit
If you actually check your access_log for the partner entry, you'll see it's a request for the SEARCH command which seems to be a new IIS exploit heading around. My vulnerable 1.3.28 also spits out:
[Sun Apr 11 00:45:43 2004] [error] [client 24.78.143.66] request failed: URI too long
You haven't identified the problem at all. I just wish there was an easy way to filter out those requests before they hit by Apache and crapfill my logs.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
Slackware-current has Apache 1.3.29, which happens to be the version listed as not vulnerable.
If you're running Slack, just download the source, run apache.SlackBuild, and upgradepkg to become non-vulnerable.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
If you look up the specifics of the vulnerability CAN-2003-0542, it's something to do with mod-alias/mod-rewrite. If someone creates a bunch of rewrite rules in a .htaccess or httpd.conf that match 9 "captures", it can trigger a boundary condition/overflow that can cause bad things to happen.
It's a little late for the buffer overflow to be hitting Slashdot's Apache news. The fix was known and published back in December 2003.
Red Hat backported the fix into their custom 1.3.27 version in this errata, released 12/18:
https://rhn.redhat.com/errata/RHSA-2003-405.html
Why is this article not so hot? Well, because the upgrade process is so easy, for us!
- A Weblog from Nigeria