Apache 1.3.33 Released

harmgsn writes "Following the release of Apache 1.3.32, the Apache Group released Apache 1.3.33 to fix a security flaw in mod_include and in the Content-Length field. The official announcement is available as well as the ChangeLog for the 1.3.x series."

Comments

How

[igzat]

Will there ever be software released that doesn't have flaws or bugs, or is that just utterly impossible? Even the Mozilla foundation has vulnerability and bug problems, and they have some of the best coders out there.

Re:How

[Anonymous Coward]

Yes, I think there is one, it is called the "Hello World" program.

Re:How

[Anonymous Coward]

Did you check the return value of the printf call?

BUGGY!

Re:How

[pavon]

Sure, no one has found any bugs Knuth's TeX in years. Same for Qmail, and others. You have to know exactly what you are doing before you start - which often means writing a throw away version of the software first to work out the kinks in the design. You have to have a simple clean design, and coding practice - as one of the Unix developers said debuging is 10x harder than writing code, so you you write code as cleverly as you can, you are, by definition, not qualified to debug that code. You have to know upfront how to write secure code, and think about with every function you write - never put this off for later. Then you have to have some one else rigorously read over every line of code to find any mistakes. Lastly you have to systematically test each part of the code individually and together. Then after years of widespread use without any major feature changes you will have weeded out nearly all of the bugs.

Nearly all software that is written leaves out some of these things, choosing to balence getting something done with quality. Some find a better balance than others :)

BTW. The mozilla programs are definately good programmers, but the codebase is certainly not the paragon of clean code. It is huge and unweildy, which is the main reason that Apple chose to build off of KHTML instead of Gecko when they made Safari. The situation has improved over time, but making an existing non-secure program secure, is much harder than doing it (mostly) correct from the start.

Re:How

[Neil Blender]

Does mkdir have a bug? I don't bloody think so...

Ah, but mkdir has had bugs in the past. I can't remember exactly, but at one time mkdir had a race condition problem affecting ownership and permissions (akin to not using transactions in sql). I think it has had other bugs as well.

Re:How

[Goonie]

Sure, no one has found any bugs Knuth's TeX in years.

Knuth is a freak of nature who spent eight years writing a program on his own, largely for his own edification and completely free of commercial pressure. Few others have that freakish ability, fewer still get to work on their pet project by themselves for that long before offering it to the world. So there are limits to how many lessons can be drawn from this very unusual example.

Re:How

[mcrbids]

Secure code is HARD to write!

Even properly structured, carefully written stuff will contain securiity bugs! It requires attention, more attention, and yet more attention still.

It requires proper layering of the code so that the number of variables to track at any one point is as small as possible.

Spend lots of time on design. Draw flowcharts to cover key areas of your application. kivio is your friend! Consult your flowcharts before you make changes to the program. A well-layed-out flowchart can be worth more than reams of notes in the code.

Above all, structure your code so that the default behavior is secure in the event of a failure.

For example, you've done something stupid, and you're passing unescaped text to the database.

Whoops!

1) Why are you passing text directly to the database? If you communicate with the database with a proper API, you *can't* pass unescaped text to the database.

2) Are you capturing the errors from the database, so that you aren't displaying any obvious sign (to the public) of what's gone wrong?

3) Is the database connection transacted, so that you can return to a known good state?

4) Do you have some kind of error trap or handler so that you can find out exactly what the errors were and fix them in a sane way?

5) Have you tested your code with DELIBERATE bugs so that you know how it will behave in the event of a failure?

The hendling of any errors from that should *NEVER* be made clear to the outside, only that "an error has occured".

The goal is a system designed with multiple layers of protection so that a failure at any point does not result in a security breach! It should fail securely, so that problems result only in error reports, NOT SECURITY HOLES.

Easy to say, damn hard to do...

Re:How

[vawlk]

I am just reminded about how many apps that I used to run on my old 8086 that never needed patching. Same with old console games...they always seemed to just work.

Then again, apps are much more complicated nowadays.

On the other hand, the wide reach of the internet allows for easy patching which can lead to sloppy coding since updates are too easy to aquire.

Re:How

[pairo]

Sure, no one has found any bugs Knuth's TeX in years. Same for Qmail, and others.
Er, wrong. qmail has had a couple of security flaws, and more than a couple of bugs. For a more exhaustive list, Google is your friend.

Re:How

[Taladar]

If you want a bug-free system in the long run you should not hide (unexpected) errors from the user. Your program should alert the user in the best way it can (not some hidden logfile) so the bug gets reported and fixed.

Re:How

[Chexum]

...more than a couple bugs...

Many of the "bugs" listed above are arguable, and frequently disputed by qmail users and opponents. That is, many of them could not be a reason to single-handedly strike down qmail itself.

As an example.. From the above document:

All the contents of this document refer to qmail-1.03.

4.3. Bandwidth hogging (violates RFC-2821 SHOULD clause)

So.. qmail 1.03 was released in June 1998, RFC 2128 was released in April 2001. I'm inclined to say that calling this a "violation" is not that fair. Even more so if you consider that it might have been included in the RFC *in response* of qmail's behaviour by *ahem* some lobbyists. In contrast, qmail's behaviour was explicitly chosen by its author, and he directs anyone who claims this is "hogging", that they should "measure, not speculate" of the implications of the behaviour. What did he get?

And, allow me to say, in my opinion, a "SHOULD" clause is not violated if the "full implications" are "understood and carefully weighed", which has apparently happened.

So, what meant is, the picture is not so clear, you should not believe anything you hear or say on the internet... Not even about qmail.

Re:How

[gbjbaanb]

nothing to do with complexity really, your old 8086 was never connected to the internet as we know it, and security was more a case of choosing a password that wasn't 'password'.

Today, I had a new linux server installed for me, and before I even told my customer his mail address, he had spam sent to it, and the server was subject to 2 attacks that BFD detected.

Your old apps probably had all those security flaws in them, just nobody was interested in looking for them.

Re:How

[pairo]

Yes, some of the bugs in there may not be bugs at all, but some are valid. I didn't say qmail should be 'struck down', even though I see no reason to use it what with modern MTAs around (MTA flame war! :-P), I was just debating the parent's claim that qmail is relatively bug free.

Re:How

[lauterm]

as one of the Unix developers said debuging is 10x harder than writing code, so you you write code as cleverly as you can, you are, by definition, not qualified to debug that code

I've heard that saying attributed to Kernighan usually.

Re:How

[Pxtl]

First and foremost: don't use the C standard library. glib or C++ standard lib. C standard library is security suicide.

Re:How

[k98sven]

Nope. All software has bugs.

A relative of mine worked with a guy who wrote a program to do a single thing: Terminate itself.
(They were doing OS programming and this was actually a useful thing to have in that context.)

That's it. The simplest possible program you could write. It was a single assembly instruction. So the guy started bragging about how he'd written the only bug-free program, ever.

Well.. the gods did not look kindly upon that hubris. It turned out he'd forgotten something. He'd forgotten to zero-out the register containing the programs exit code. So the exit code would be just whatever random value happened to be in the register. And a non-zero error code indicates a termination on error. There was a bug in the simplest program ever written.

So..no, there is no flawless software which does anything non-trivial. It's hard enough to get the trivial stuff right.

Re:How

[LiENUS]

Here ya go fixed spec and code

#include <stdio.h>

int main(int argc, char *argv[]) {
int retval;
retval = printf("Hello, World\n");
if (retval > 0) {
return 0;
} else {
return -1;
}
}

Re:How

[ratboy666]

"*NEVER* be made clear to the outside"? What *is* the "outside" when providing toolkit software?

"Why are you passing text directly to the database". Um... because the API to a SQL database is SQL which is... text?

You have eliminated the use of PHP (since if the interpreter fails, where is the error reported?) *and* SQL (because the API is text based) in your web page developement. Yes, I agree that would tend to increase security, but at what cost? Are you trying to eliminate your own job?

Ratboy.

Re:How

[DrSkwid]

Debugging is twice as hard as writing the code in the first place. Therefore,if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it.

-- Brian W. Kernighan

Re:How

[Kinlan]

Hard as in NP Hard?

Re:How

[NardofDoom]

Here's one:
function hello(){ print "Hello, World!"; }

Though most frosh comp sci majors still seem to screw it up.

Re:How

[jack_csk]

//My version is shorter than yours
#include <stdio.h>

int main(int argc, char * argv[]) {
return (printf("hello World!\n")<0?0:-1);
}

Re:How

[mcrbids]

"Why are you passing text directly to the database". Um... because the API to a SQL database is SQL which is... text?

Ahem...

Here's an example of BAD YOU-ARE-SO-OWNED CODE ...

$sql="SELECT * FROM userdb WHERE login='".$_REQUEST['login']."' AND password='".$_REQUEST['password'].'";
$res=mysql_ query($conn, $sql);

Here's an example of MUCH BETTER CODE...

$DB=New Database();
$DB->SetQuery("SELECT * FROM userdb WHERE login='@login' AND password='@password'");
$DB->Set('login', $_REQUEST['login']);
$DB->Set('password', $_REQUEST['password']);
if (!$res=$DB->Query())
return Error("Sorry. There was an error while processing your request");

Notice that the values being passed thru to the database are not being sent directly (there's that word, maybe you missed it?) to the database. This way, you can't (easily) make the mistake of not escaping the value before it's passed to the database - that's handled by object $DB.

Ratboy.

Re:How

[baest]

Sorry, but that is wrong. You return 0 when printf return less than 0. I would rather do this which is actually faster... #include int main(int argc, char * argv[]) { return (printf("hello World!\n")); }

Re:How

[Jucius Maximus]

"Even properly structured, carefully written stuff will contain securiity bugs!"

You'd know, I guess. ;)

Good thing I use Apache 2

[brandonp]

Been using Apache 2 on Fedora Core for the past few months, so shouldn't have any worries.

Brandon Petersen
Get Firefox!

Re:Good thing I use Apache 2

[eobanb]

Personally, I'm waiting for Apache 1.3.37. 0h y34h!!!

Re:Good thing I use Apache 2

[geminidomino]

For some reason, I heard Quagmire in my head when I read that...

Giggidy giggidy!

One small change

[jZnat]

So, one small change was made to prevent dumbasses from fucking over the buffer if they use characters not intended in the first place? Not worth it without updating other bugs, sorry to say. Work on the more important yet less known bugs instead!

Re:One small change

[Electroly]

Without that "one small change", someone could own your computer by just sending a specially crafted HTTP response when you hit a website. I personally think anything that can allow "bad people" to get access to your computer without too much difficulty is something that should get fixed. Suit yourself.

Re:One small change

[corrie]

You must be trolling.

This kind of thinking leads to worms and trojans being so prevalent.

It is besides the point that the "characters not intended in the first place". The point is that it is possible for them to get there, and so they should be dealt with.

Btw, I would like the URL of your unpatched Apache site, please. Thanks so much. Don't be afraid, because I'm not supposed to send any unintended characters there, so I won't, right?

Re:One small change

[jZnat]

That's why you don't use the server box for other things at the same time. ;)

Re:What ever

[mirko]

Well, Apache 2 doesn't support all the mods at this moment, for example, it is still impossible to use some auth_tk (not sure about the name, to autologin in our Intranet.

A little overblown

[Stevyn]

After looking at the changelog, is this a topic for the main page? I mean people complain when a minor revision of the Linux kernel or KDE comes out.

Not to say that justifies it, but this is just one bugfix. I hope people maintaining servers running Apache don't rely on Slashdot to inform them of this bug. This seems more an issue for a mailing list.

Re:A little overblown

[Anonymous Crowhead]

After looking at the changelog [apache.org], is this a topic for the main page?

No kidding. The Apache section is like Ralph Nader. It's always there, it gets about 1% as many comments as any other section, a boring story about it still hits the headlines now and again, but you try to get rid of it and it gets all crazy.

Re:A little overblown

[Anonymous Coward]

Don't blame me, I voted IIS.

Re:A little overblown

[Stevyn]

Yeah was this one of the original sections or something? Couldn't this just be thrown into IT? After all, it's IT people who would be interested in subject matter like this.

I'm not saying Apache isn't important at all, but important as Science, Developers, AskSlashdot, Apple? I don't think so.

Re:A little overblown

[Neil Blender]

No kidding. The Apache section is like Ralph Nader. It's always there, it gets about 1% as many comments as any other section, a boring story about it still hits the headlines now and again, but you try to get rid of it and it gets all crazy.

Heh, that reminds me: About 3 or 4 years ago, I was up late fixing some server issue. While I was waiting around I checked Slashdot and saw a story in the Apache section about some Apache conference or party or something that was taking place in Belgium or Norway, I can't remember exactly. It had been up for hours, maybe even days with no comments. So, thinking it would be like taking candy from a baby, I first posted. About a week later, I checked the same story and the only post was my first post. I think that story got archived with that single post.

Re:A little overblown

[Trepidity]

God we're geeks :)

People told me that I shouldn't take the comments on Slashdot seriously because they are inaccurate, but I believe I have evidence to the contrary.

Re:A little overblown

[Gheesh]

Apache 1.3 is a well established product, with over 65% of the market share. It is important that security flaws are quickly found, fixed and patched everywhere, to avoid possible exploits (esp. worms) from spreading and choking the net. I'm sure you can think of good examples of why this is good practice ;-)

Re:A little overblown

[geminidomino]

I have a feeling it's MUCH more important than "Apple" to those who run it on non-Apple architectures.

Re:A little overblown

[Tony-A]

With all the stories on Microsoft exploits, the Slashdot editors are trying to give equal time.

"mod_include: Fix potential buffer overflow with escaped characters in SSI tag string."
-- At least it's a different one.

"Multiple security issues ... that could allow an attacker to compromise a computer running Windows and gain complete control over it."
-- I thought they fixed that already.

Re:A little overblown

[Ctrl-Z]

If the IT colour scheme ever gets fixed, then I would be all for putting Apache stories in IT. Otherwise, I have to say I find the Apache colour scheme to be much less hideous than IT (even though the purple is a bit putrid).

Re:I can't figure this release note out

[Anonymous Coward]

If you are running Debian Stable, then you are relying on the most solid version of Linux thus far. The Debian team does not spend time working on adding new features to the platform, so all efforts are instead diverted to bug fixing. In Stable, the likelihood of an 0wn4ge is slim to none, in other words. At least much less than in the other Debian versions.

That said, that only pertains to the operating system and accompanying binaries. It does not cover Apache. If there is a bug in Apache that allows the takeover of a system, a hacker could theoretically exploit that hole and cause damage to your system.

However! The damage that is possible via a hack such as this is limited to the permission level at which Apache is running. If it is running as root, well, your whole system is exposed. OTOH, if you have Apache locked down with no permissions whatsoever, the likely damage to your system is minimized.

Re:What ever

[synthparadox]

Don't forget that mod_gzip is not fully supported in Apache 2.X.

Also, has anyone else noticed that slashdot itself is still 1.3.29?

Re:What ever

[ScytheBlade1]

After searching a bit, I can't find the netcraft page that lists which apache version (1 or 2) the % of sites are using...but for some reason I remember apache2 being actually *used*.

Hence why it's default now on a grand many distros...and many many others...

(Chances of you being right about it being more of a security risk? Depends on your view, namely the time it's been out vs. the time apache1 has been out. But hey, why not at least post proof with your post compared to just stating such things blindly?)

I tried to migrate to Apache.

[shaneh0]

During last years jihad on IIS & IE I decided it would be a good idea to migrate the company's web servers to Apache. I decided to start simple and submit a plan to migrate just the department intranet server.

This is the actual response from management. The brain-dead VP that made this truly-enlightened decision first made a name for himself as a VP at a FAUCET COMPANY.

Listen to the faucet kings great idea:

"Shane, Thanks for your proposal. Unfortunately, I cannot approve the change. In fact, I've decided that we need to streamline these things in the future and make sure everyone is on the same page.

From now on, we will only install software on the servers that is at version 2.0 and above. There will be no exceptions to this. It's about security and reliability. Everyone knows you dont buy a car the first model year, why should software be any different. I've never heard of apachee, but if these guys are as good as you say they are enough people will bite to keep them going, and when they come out with the next major realease I think you'll see then that we're better off for waiting for them to really get it right.

thanks for beging on board with this, tom." [my name's shane]

Two years ago this guy won the "visionary of the year" award at the company conference.

Re:I tried to migrate to Apache.

[mrchaotica]

Luckily, there is an Apache 2.0!

Re:I tried to migrate to Apache.

[quillsta]

I was called by the wrong name 8 months into my current job staying in a company flat with the CFO in london (now 2nd Sr. Admin). I feel the v2.0 scenario and it hurts my heart. blessed be (God|Allah|Jeebus|Jehova|Budda|Mr. Dobbs) and blessed be apache 1.3.x.

jez don't speak as though 2.0 is not primetime, because that is crazy speak -- the configuration files may have new directives and options, but yours is to weigh costs of access/benefit/detriment and deploy accordingly.

Take time to read and don't be swayed by a jihad. If you are really unsure of what one is google it and you will see it is not what you think

Re:I tried to migrate to Apache.

[jesterzog]

Out of interest, how did you respond?

Re:I tried to migrate to Apache.

[Vellmont]

The idea is sound enough, we all know of course that no one adheres to any standards with regard to software revisions. Some software goes for years at version 0.x, and a 1.0 release is a really exceptional product. Others (like Microsoft) take at least up to version 3 for the thing to be actually useable.

Anyway, you should have (or perhaps you did) play his game and announce that Apache 2.0 has been out for more than 2 years. As far as the ridiculous >= 2.0 policy, I'd go the route that software companies know this trick and will inflate version numbers. That way the VP doesn't look like a total moron and can save some face when the policy goes the way of the dodo

Re:I tried to migrate to Apache.

[pchan-]

i would love to have had the chance to respond to this.

you could just download apache, edit the code and bump up the version number. but really, the right solution would have been to inform him that, in fact, there exists an "apachee 3.0". unfortunately, "apachee 3.0" is no longer free, and requires a 500$ yearly site license for under 10 installs (and reasonable fees for more). then you can bump up the version on apache 1.3 and install it on the company's computers. your friend (er, the "apachee foundation") can cash the yearly check for you.

Re:I tried to migrate to Apache.

[tigress]

No, you don't buy a car the first model year (1.0). That's why you wait for Car 1.1 or higher. Waiting until the new model (2.0) is out is just plain stupid. :)

Re:I tried to migrate to Apache.

[snero3]

Somebody probably has already mentioned this to you but you do know that apache does have a version 2? They are currently maintaining both the version v1 and v2 trees. Just thought I would let you know.

Re:I tried to migrate to Apache.

[shaneh0]

Although I can't believe you're interested, I'll tell you how I handled it.

I work for what you could call a 'large company.' You could also call it by a more formal term, 'the largest company in the United States'.

This has upsides and downsides. A downside, for example, is the Department VP. An upside is that there are 2 other department VPs and they gave me the go ahead on the condition that I never tell the other. They probably have a point that a friggen Vice President would never know what Web Server was installed unless somone tells them.

Although I didn't know at the time of the 2.x versions, looking back I wish I did because it would have saved some headache.

Re:I tried to migrate to Apache.

[NoMercy]

*rolls around on the floor laugning*

Ohh, it's quite amazing how many Dilbert Style managers are out there, take him along to a dogbert re-education class :)

Re:I tried to migrate to Apache.

[geminidomino]

'the largest company in the United States'.

You poor bastard... you work for the Federal Government... Come inside, we'll give you a nice bowl of soup and let you talk to a chaplain of whatever belief system you follow. Yes, we do have an athiest chaplain. He's kind of an odd one, but a good sort.

You must be so cold. Come, come inside.

Re:I tried to migrate to Apache.

[OwlWhacker]

There are plenty of people with high positions in business that are really holding their company back.

All it takes, in most cases, is a bit of research. With the Internet, research is no hassle whatsoever. This guy obviously has no clue of what Apache is, and isn't even going to research it due to a version number.

You can't apply a one-size-fits-all approach to everything. Each seperate case should be evaluated in context. Obviously.

I would suggest going higher up, and put together something concise, positive, and polite, and ask for an evaluation of the issue. Provide proof that Apache is big, reliable, used by big companies, and something that should not be brushed aside in ignorance.

You may even find that this guy is demoted. Probably not though, seeing that somebody higher up actually gave him that position in the first place.

Re:I tried to migrate to Apache.

[poot_rootbeer]

...So why didn't you migrate from IIS to Apache 2.x? ;)

Re:I tried to migrate to Apache.

[cant_get_a_good_nick]

Hmm, Pinto 1.0 wuz da bomb...

Re:I tried to migrate to Apache.

[nicolas.e]

They migrated from Apache to IIS (at least for their website) ?

Re:What ever

[myg]

Apache 2 has quite a few good things going for it over Apache 1. First off, it handles multi-threading much better meaning that very heavy workloads require less CPU time[*]

Second, Apache 2 supports things like DAV which mean that to publish information on the web users need less access than with Apache 1 (such as shell accounts or worse FTP, since most ISP's don't think users should use SSH for some odd reason).

Lastly, Apache 2 can run Subversion. So not only can you use DAV to update information without shell access of any kind but you can version that information too.

[*] Why is multi-threading faster than the pre-fork model of Apache 1? Because there is less work to do when context-switching threads. A thread shares the same virtual address space with other threads in the process. Changing virtual address spaces is slow because it requires a TLB flush (as well as one or more extra registers to save). The TLB flush increases memory accesses.

Re:What ever

[FireChipmunk]

FUD.

mod_defalte does GZIP encoding, and comes with the Apache 2.0 core:
http://httpd.apache.org/docs-2.0/mod/mod_deflate.h tml

Re:What ever

[PhrostyMcByte]

SF.NET just sent out an email a few days ago:

The SourceForge.net team is pleased to announce the long-awaited
upgrade to our project web service. SourceForge.net staff are
currently in the process of completing hardware procurement and
system build-out. The official date for this upgrade has not yet
been set; once our hardware build-out has been completed, the
date will be announced on the SourceForge.net Site Status page.
https://sourceforge.net/docs/A04/

This upgrade consists of a significant hardware upgrade and
Operating System upgrade. Due to the large upgrades involved here,
it may be necessary to upgrade your scripts.

...

New configuration:

Fedora Linux: Fedora Core 2
Linux kernel 2.6.x
GNU libc 2.3.3
Apache 2.0.51
Perl 5.8.3
PHP 4.3.8
Python 2.3.3
Tcl 8.4.5

Apache 2.x is good enough for a large site such as sf.net, it is good enough for others.

Re:I can't figure this release note out

[mrchaotica]

does this effect me?

I don't see how it could, since "effect" is a noun.

I don't want to loose the security battle

Well, better keep that battle tied up then!

[note to mods: With a story this useless, what else could I do but correct usage (I'll leave grammar and capitalization as an exercise for the reader)? I mean come on, the front page for a bugfix?!]

Re:What ever

[nv5]

I'm assuming you're not trolling, so would you mind elaborating a bit?

Re:What ever

[FireChipmunk]

No one uses Apache 2 in production. I guess all those sites don't have a clue about security.

Riddle me this then?

[Bill_Royle]

Why is your server running 2.0, then?

Netcraft's "What's That Site Running?" report on www.force-elite.com

I'm assuming by your nick here that you're Chip, of course.

Re:Riddle me this then?

[Anonymous Coward]

I think you missed the point.

Every site I linked to was running APACHE 2.0.

Re:What ever

[Quattro Vezina]

You forgot one.

Re:What ever

[Quattro Vezina]

I can't but help noticing you made a typo. Your entire message should be spelled ``FUD''.

Re:I can't figure this release note out

[pairo]

In Stable, the likelihood of an 0wn4ge is slim to none, in other words.
How about this, or this then?
No distribution is inherently more secure than another, a Debian Woody machine will be as easily compromised as any other distribution, if the admin is incompetent. (And, no, I'm not saying all machines are compromised because of incompetent admins)

Re:Apache is awful.

[killjoe]

Wow cold fusion and jrun? People still use those? Are they running as modules or a CGI?

Maybe you should go back to IIS. You should not run a web server you can't get working. Leave apache for other people.

Mod_ssl?

[mcrbids]

It doesn't appear that mod_ssl 1.3.33-NNN is available yet. I can't update until this is done, or all my ssl sites break.

ugh...

and I'd just started rolling out 1.3.32!

Re:Mod_ssl?

[Phroggy]

Because this version is only a number bump and a fix to mod_include, I'd be doubtful as to whether this would affect mod_ssl at all.

I'm sure you're right, but that number bump would be enough to make mod_ssl-2.8.21-1.3.32 not install without fuss.

Re:Mod_ssl?

[jimjag]

mod_ssl includes the 'force' option that bypasses the version check. Works like a dream and the version for 1.3.32 applies like butter to 1.3.33

Re:Apache is awful.

[pairo]

I'm only going to comment on two bits of your post, since I've never used ColdFusion/JRun with Apache (Or at all, for that matter) and cannot address the main issue.

disabled all uneeded services, performance tuned our app

You only did that _after_ you noticed your application is having problems?

As opposed to . . .

[WinterpegCanuck]

Following the release of Apache 1.3.32

what, it would follow 1.3.34?

Re:As opposed to . . .

[Gopal.V]

Often 1.3.34 follows 1.3.32 for GNU style namings ...

Think how 2.4 follows 2.2 kernels ?.

Re:As opposed to . . .

[Nomikos]

Can't wait to be able to run 1.3.37, then I would be truly.. ehr..

Re:As opposed to . . .

[cant_get_a_good_nick]

apache doesn't follow that, though it skips releases every once in a while when it finds the release has a bug. They put out brand new code, and don't reuse the version number.

why cant they just release patches?

[xot]

Do they have to keep releasing a new version everytime a bug or security flaw comes up?
Why not just release patches for the bugs and just update the patch tree??

Re:why cant they just release patches?

[pairo]

Because it makes it easy to keep track of wether you're vulnerable or not. Because it makes it obvious something important changed. Because it allows them to release a couple of other patches as well.

Re:why cant they just release patches?

[geminidomino]

I had that problem a few years back. Well, I didn't have the problem, but my boss at the time sure thought I did. He wasn't a PHB, just a BSDite like me who'd never used Redhat until he bought a stupid system based on it.

T'was around the time of the great OpenSSL vulnerabilities... As a lowly admin, my job was to update all the broken things to keep our servers up. So I did, using RH rpms. Of course, $BOSS didn't realize that RH (at least at the time. Never EVER touched it again after leaving that job) backported fixes and increased the patch level instead of the version number.

Oh, how he yelled! How he accused me of slacking off instead of doing my job. How he ate crow when I let him finish and pointed it out to him.

Re:why cant they just release patches?

[Vitus Wagner]

Because it makes it easy to keep track of wether you're vulnerable or not.

Especially it makes easy to track for everyone who send HEAD request to your server, because Apache dutifully report its version in the Server: header with default settings.

Re:why cant they just release patches?

[pairo]

You can easily turn that off.

Re:why cant they just release patches?

[rseuhs]

Because then we would be in the land of pain like all IIS-admins.

"Wait a minute, is version 4.07-SP2 with hotfixes 78302, 78748, and 79391 now safe from exploit 17293-B or not?"

The thought alone gives me the shivers.

Re:What ever

[pairo]

Cough.

Re:I can't figure this release note out

[value_added]

"I don't see how it could, since "effect" is a noun."

Good try (and moderately funny) but no cigar. The word "effect" can be used as a noun *or* a transitive verb in which case the meaning can be read as "to bring about." That, too, would be moderately funny, for an entirely different reason.

The word "affect," on the other hand, is most commonly used as an intransitive verb, though its usage as a noun still exists (e.g. "affectation").

[Web-link-as-pseudo-authoritative-citation omitted.]

Re:Apache is awful.

[LnxAddct]

Wow... did you ever here the cliche of a face so ugly it breaks mirrors... that site is so horrendous it breaks apache. Anyway...your huge community doesn't seem to be all that huge... google uses a modified version of apache, slashdot uses apache, sourceforge.net uses apache, and Amazon.com runs apache... as well as many others. If your having hours of downtime a day you must not be all there in your head. Seriously, go download Fedora Core 2, install it, everything will be set up for you... port your code to php or jsp or whatever if your finding it unstable. Coldfusion is hell and way overrated. If your going to use opensource, go completely open source because thats what it was designed with in mind. But judging from your website, you've got a lot more work to do then just getting a server running properly. Ugh... go buy a book or two, one for servers and one for web design. I'm not trying to troll... I just can't believe what this guy said, never in all my years have I had any trouble with Apache, whereas I also admin an IIS server and its *hell*...but it pays the bills:)
Regards,
Steve

Re:Apache is awful.

[WinterpegCanuck]

Ever consider contacting a consultant (or high school kid) that knows how to set it up properly. One of the largest XP Themes sites uses a totally non MS server and couldn't really handle the traffic on the same hardware without a non-ms solution.

Unfortunatly, despite your best attempts to slander the apache software, it looks more like pebkac

No...

[Goonie]

So Knuth is the only open source developer to write his own code and thats freakish?

That's not what I meant at all. What I meant was by the comment that Knuth is a "freak" that Knuth is a freakishly talented individual. And, yes, Knuth's situation is pretty unique, even for open source developers. Not only does he have tenure (that means they can't sack him), because of his reputation he's able to spend his time doing pretty much whatever he wants to do free of the restrictions on ordinary academics, like that little thing, "teaching", or sweating over whether he's going to get published. So he could hack away at TeX as and when the mood took him, without any pressure from his boss to actually produce anything, or any users badgering him for a new release, or figuring out how the other developers had screwed up, or trying to implement broken bits of the standard (because there *was* no standard).

They are *not* the typical circumstances under which most developers have to work.

Re:No...

[martin_b1sh0p]

Apparently his code does have bugs from time to time:

From http://www.tug.org/whatis.html
Donald Knuth, a professor of computer science at Stanford University and the author of numerous books on computer science and the TeX composition system, rewards the first finder of each typo or computer program bug with a check based on the source and the age of the bug. Since his books go into numerous editions, he does have a chance to correct errors. Typos and other errors in books typically yield $2.56 each once a book is in print (pre-publication "bounty-hunter" photocopy editions are priced at $.25 per), and program bugs rise by powers of 2 each year from $1.28 or so to a maximum of $327.68. Knuth's name is so valued that very few of his checks - even the largest ones - are actually cashed, but instead framed. (Barbara Beeton states that her small collection has been worth far more in bragging rights than any equivalent cash in hand. She's also somewhat biased, being Knuth's official entomologist for the TeX system, but informal surveys of past check recipients have shown that this holds overwhelmingly for nearly everyone but starving students.) This probably won't be true for just anyone, but the relatively small expense can yield a very worthwhile improvement in accuracy.

On and off topic

[WinterpegCanuck]

Back at my old ISP before the big Telus bought us out, we had both IIS and apache servers. the apache servers hummed steadily in the corner, pumping out pages like nobodies business while the IIS took so much maintenance and work, we ended up creating a script to just reboot the things every few days.

. . . and speaking of pour websites, one of our old customers (I had to try and answer his question in a professional way as to why people weren't coming to his website) designing-websites.com although he has gotten a lot better than what it was before

Re:I can't figure this release note out

[thomasweber]

Well, http://mplayerhq.hu/pipermail/mplayer-dev-eng/2003 -December/022821.html is just one of the usual rants of mplayer against Debian. If you go further in this thread, you will find http://mhttp//mplayerhq.hu/pipermail/mplayer-dev-e ng/2003-December/022879.htmlplayerhq.hu/pipermail/ mplayer-dev-eng/2003-December/022877.html> and http://mplayerhq.hu/pipermail/mplayer-dev-eng/2003 -December/022879.html, which show that the admin didn't have a clue how his server was compromised (it must be the kernel and/or Debian, because he is a perfect admin, or what?).

Re:Apache is awful.

[LardBrattish]

Yeah, Apache is more secure

No Shit Sherlock

and open source,

That's immaterial

but it isn't as good for enterprise as IIS is.

Bull. I'd finger either poor coding by your developers or poor administration of Apache/Coldfusion. Or maybe you were trying to run Apache on Windows which is not a good idea.

Apache is more difficult but it's not that much more difficult. There are even web administration tools that make life easier.

My first Apache config script worked ok but I had to do a bit of digging around on the net before I got all of the info I needed. M$ had a bad habit of making stuff appear easy by making lots of default choices for you that you might not make if you were given the informed choice.

Windows 3.1 anyone '?.

[Gopal.V]

> From now on, we will only install software on the servers that is at version 2.0 and above

Hmm.. let this guy install Windows 3.1 on the servers (apparently that *is* > 2.0)

Hmm.. maybe I wonder if Knuth did a good thing by freezing TeX at 3.14 (or was it 3.14.15...)

"visionary of the year" award

[Cl1mh4224rd]

Apparently those visions included lots of shifting colors...

Try phpBB

[Anonymous Coward]

I'll have to chime in and join the speculation that the problem lies with CF. I didn't even know CF would run under Apache.

Try installing phpBB, it's free, and moderately pretty by default. The only hitch would be migrating your existing user accounts. If you have their passwords in plaintext, just examine phpBB's registration code, and write a script to insert your existing users into phpBB's database.

I have phpBB running on a site with about 8,000 users that gets 1500+ posts a day. Works great and it's free!

Re:What ever

[Anonymous Coward]

How is that FUD? Inaccurate maybe. But the functionality is there, if only by a different name.

Parent deserves insightful.

[Anonymous Coward]

It's both sad and funny, but I'm (a VP) finding the exact same trouble, with a CEO not understanding of any software without commercial support. No problem - I've got underemployeed friends who know postgresql, and sure enough by re-labeling it XYZ-corp-postgresql and a contract to update when upgrades come out, and to forward requests between the company to&from developers on the mailinglist when/if other problems occur, everyone was happy.

Nothing sneaky was done - the CEO still knows it's open source - but now he has a phone number to call and can drag someone to his office.

Rather than laugh, I'd say go for it. If your friend owns a suit and prints a nice business card it could be win/win for everyone.

Content-Length in mod_proxy

[morten poulsen]

It is worth noting that the Content-Length security problem is in mod_proxy, not in the main daemon.

See CAN-2004-0492 for details.

In other news....

[abdulwahid]

Kernel developers today released the eagerly awaited linux kernel 1.2.14. Everyone should update to this latest version as soon as possible to make use of the security fixes that this update provides.

Re:I can't figure this release note out

[Scarblac]

Security effects ALL of us.

ITYM the other way around - it's LACK of secure (safe) sex that effects all of us.

Re:What ever

[bustersnyvel]

www.apache.org - Apache 2:
HTTP/1.1 200 OK
Date: Fri, 29 Oct 2004 09:17:14 GMT
Server: Apache/2.0.52 (Unix) ....

www.redhat.com - Unknown apache version:
HTTP/1.1 200 OK
Date: Fri, 29 Oct 2004 09:18:05 GMT
Server: Apache ...

www.cnn.com - Unknown apache version:
HTTP/1.1 200 OK
Date: Fri, 29 Oct 2004 09:18:45 GMT
Server: Apache

www.cnet.com - Apache 2:
HTTP/1.1 200 OK
Date: Fri, 29 Oct 2004 09:19:08 GMT
Server: Apache/2.0

www.bbc.co.uk - Apache 2:
HTTP/1.1 200 OK
Date: Fri, 29 Oct 2004 09:19:38 GMT
Server: Apache/2.0.51 (Unix)

us2.php.net - Apache 2:
HTTP/1.1 200 OK
Date: Fri, 29 Oct 2004 09:20:01 GMT
Server: Apache/2.0.46 (Unix) mod_perl/1.99_09 Perl/v5.8.0 mod_ssl/2.0.46 OpenSSL/0.9.6g DAV/2 FrontPage/5.0.2.2634 PHP/4.3.2 mod_gzip/2.0.26.1a

I guess a lot of people use Apache 2!

Re:I can't figure this release note out

[pairo]

I should know, this is my post. In hindsight, maybe I should've actually explained what I meant by those two examples.

The first, the one about the Debian machines being compromised was to show nothing is unbreakable (even though the Debian people made some mistakes in configuring those machines, their far from being responsible for that).
The second, the MPlayer one was to show that a clueless admin (Okay, I know I shouldn't call the MPlayer people names based on a single experience, but that's the impression I got from that thread.) matters more than the distribution he or she uses.

Re:apache 1-3-31 on debian testing

[Vitus Wagner]

Debian people prefer to fix the bugs without updating to new upstream version whenever possible.

I suppose that apache_1.3.31-7 package would soon hit the repository and it would have this bug fixed

Re:What ever

[aaron.rowe]

That doesn't mean the security patches are not applied.

Don't forget that even Debian Stable is using Apache 1.3.26 yet the security updates are backported to that version by the glorious debian community shortly after the announcements from Apache foundation.

Re:I can't figure this release note out

[ajs318]

When I was taking my A-levels, I helped out in my school's remedial studies unit. On the walls in there were a set of colourful cartoon posters drawing attention to commonly-mixed-up words.

One was of a stereotypical 50kg weakling in a gym, about to lift a set of weights and saying "Will this affect me?" And the answer from his muscle-bound colleague was "Look at the effect it had on me!"

Another one was a kid with an untied shoe, and a teacher calling after her, "Your lace is loose! You might lose a shoe!" At the time, I never thought that was particularly relevant; since around my particular neck of the woods, "lose" {as in "I don't care if the Rams don't win, just as long as Forest lose"} is often pronounced so as to rhyme with "nose".

Re:What ever

[prator]

I'm using mod_dav with Apache 1.

-prator

Back to /. roots?

[FudgePackinJesus]

I really hope that, with this post, this is a hint of things to come at /.

I really think that overall feel of slashdot has changed and not necessarily for the better. I'd really like to see kernel releases, Gnome & KDE flamewars, Quickies, obscure language write-ups and everything else that made /. special in the past make it to the front page again. Instead we're getting game reviews, movie reviews and politics. Sounds more like a mainstream news source now, doesn't it?

The buzz of the open source world fell flat the last couple of years. I really hope it wasn't because of the market crash and that the core of the excitement wasn't the dream of cashing out by installing linux everywhere.

Open source, I think most people still don't realize, is the source of true power in speech in this day and age. If it wasn't for projects like Linux, Apache, MySQL, PHP/Perl/Python, etc. the web would be dominated by large corporations who would be the only ones capable of paying the large sums of cash for web-service software that would have no doubt been that most expensive software out if not for the free-as-in-beer-speech competition. Open source bestowed the average man a voice in the newest of media channels.

I truely hope the energy & excitement due to that fact never leaves... especially here on Slashdot. The editors shouldn't let the tagline "News for Nerds. Stuff that matters." limit the vibe /. gave off before because, at the end of the day, that's all it is. A tagline.

Re:Back to /. roots?

[74nova]

I'd really like to see ... Gnome & KDE flamewars

there arent gnome and kde flame wars anymore because we kde zealots won.


easy there boys, its a joke

Re:Back to /. roots?

[FuzzyBad-Mofo]

there arent gnome and kde flame wars anymore because we kde zealots won.

Like hell, KDE is the suxxor!

:p

Re:Back to /. roots?

[solios]

Don't forget the DOOD CHECK OUT MY SCHWEET BLOG ENTRY posts. Or the ads-masquerading-as-posts posts.

This used to be a nice "tip of the iceberg" place- it's where I got my feet wet with regards to linux. While the front page content is more buzzword/ad/blog centric than I care for, hey- there's filtering.

Fuck, I don't even know if Katz still posts columns or not. I got so sick of that shit that he's the only thing I locked out of my FP prefs.

So /. is getting better with age in at least one respect.

Future thought

[SirLestat]

I can't wait for release 1.3.37

qmail has bugs

[richdawe]

qmail has bugs, just no bugs that affect security. But they are bugs nonetheless.

One bug is to do with insufficient checking of a counter, so it wraps at 2GB. The worst case here is that the program crashes, I believe. I don't think it is exploitable.

Another bug is a crash on parsing a slightly weird .qmail file. I can't remember the exact details of that.

Then there are various other things that you could consider bugs. qmail doesn't comply with the current Internet standards. If you restrict bugs to mean "doesn't function as originally designed", then these are not bugs. But I think they would be considered bugs by most people, since they affect qmail's interaction with other mail software.

Re:Apache is awful.

[Gabe the Programmer]

There running as Apache modules obviously. But even then we're still being crushed under the weight of our load.

Windows update of apache?

[Ash-Fox]

Hmm, I can't seem to find the updated windows version.

Re:I can't figure this release note out

[A beautiful mind]

Yes, Árpi is actually quite incompetent at times. Btw as far as i remeber the incident it was a remote kernel exploit, nothing to do with Debian...it could have been any other linux box running the same version of kernel...

Re:I can't figure this release note out

[pairo]

Yes, but what they claimed (And, amazingly enough, they were right) was that the attacker needed to gain local access first, by exploiting a service. Nevertheless, claiming that Debian was to blame was a bit off.

Re:I can't figure this release note out

[A beautiful mind]

That's weird...why on earth a remote expoit would require local access? Thats why it is remote, no local access is required.

Re:I can't figure this release note out

[pairo]

The kernel exploit they (And _YOU_) are referring to is a _LOCAL_ exploit, it's the one that affected Debian.

And, by re-reading your post (Yeah, I know. But I'm trying to get drunk here, ya know!), I see you were wrong from the start. See above.

Advice.

[Bill, Shooter of Bul]

I'm not trying to troll, but many people make this mistake. Next time you think about migrating to a product, visit the products website to research what the latest production release is and look at a product roadmap to see if it would be worth wile to wait until a newer version becomes availiable. Then after you have done all of the research, you can present your findings to your higher ups in a manner that allows them to make an informed choice. That works wonders.

Re:What ever

[Draco_es]

Why is multi-threading faster than the pre-fork model of Apache 1? Because there is less work to do when context-switching threads. A thread shares the same virtual address space with other threads in the process. Changing virtual address spaces is slow because it requires a TLB flush (as well as one or more extra registers to save).

Not every architecture requires a hardware a TLB flush. Some of them (like ia64, I think) maintain a tag called ASID (Address Space IDentifier) so TLB entries can be shared by different processes which share memory pages. Anyway, I always thought that the real performance and scalability benefit between using processes or threads was on task creation and destruction and not on task switching. I'm not saying that a TLB flush on a context switch is negigible but by itself probably is not so important. Could you give any pointers on this?

Re:What ever

[avel599]

Ah, so that's why sites that use the Sourceforge web service have been so slow lately.

8-)

Re:Apache is awful.

[killjoe]

Apache1 or apache2? Windows or Unix?

Apache under windows is JustBadIdea if you ask me.

Re:What ever

[myg]

Yes, there is DAV support for Apache 1, but its not quite as stable or flexible as the DAV engine in Apache 2.

I'm not 100% sure but I suspect it isn't really all that supported anymore.

Re:What ever

[myg]

I'm not sure about IA-64 but yeah some processors are better at context switching than others. Threads are faster to create and do tend to take up a bit less RAM for page tables as well. Thats a good thing when you have several thousand simultaneous requests going on.

The down-side to threads is, as some posters have pointed out that a few modules (PHP comes to mind) aren't thread safe. I don't really use PHP nor do I like the language enough to bother with it.

But of the things I do use they all seem to be very happy with threads. And for Win32 users the threading model is pretty much their only model.

Re:What ever

[Nevyn]

First off, it handles multi-threading much better meaning that very heavy workloads require less CPU time[*]

Well that's hard given that apache-1.3.x doesn't use threading at all. Of course all the Linux distributions still ship with the "old" pre-fork method, because it's just as fast on Liunux ... and much safer, reliable and compatible.

[*] Why is multi-threading faster ... Changing virtual address spaces is slow because it requires a TLB flush

Doing a task switch, even without a TBL flush, is still much slower than not doing a task switch at all. Using two servers, apache for dynamic content and a fast one for static content is fairly common ... and much faster than apache 2.0.x.

And you are sacraficing a huge amount of reliability for that small TLB "improvement", then of course you have to take into account the extra locking needed in the threaded app. and the SMP cache invalidation traffic when you alter hot objects etc. Of course I'm sure you've measured all this ... not.

Re:Apache is awful.

[llefler]

Or maybe you were trying to run Apache on Windows which is not a good idea.

Running Apache on Windows isn't necessarily evil either. It's good for Windows shops or when using another OS would make the learning curve incredibly steep.

I use Apache/Win for my CGI SOAP services. While they are internal servers, they still get a moderate load. And I've never had a minute of trouble with Apache.

I'm also using Apache/XP/Firebird on my laptop to learn PHP. Which will eventually be moved to my Apache/Debian/Firebird server.

Apache Security Documentation

[mrkitty]

http://www.cgisecurity.com/webservers/apache

Re:What ever

[Megaweapon]

I think it has been out long enough to bang out the bugs. Even though 1.3.x is still being patched I think A2 is ready for prime time. We're close to implementing it in our shop in a production environment.

Re:apache 1-3-31 on debian testing

[DerelictMan]

As a newishbie sys admin, what is the best policy in this situation, hiding apache behind a firewall or shutting it down till the fixed debian version hits the repository, or risk waiting for it to hit without shutting down?

Do the following:

• Check the Debian changelog (zless /usr/share/doc/apache/changelog.Debian.gz). Frequently fixes are backported but the version number isn't necessarily bumped. One of the vulnerabilities fixed in Apache 1.3.33 (CAN-2004-0492) has already been backported to Sarge in version 1.3.31-2.
• Assess the risk to your installation. The other vulnerability (CAN-2004-0940) requires local access AND requires that mod_include be installed. If I'm not mistaken, mod_include is not enabled by default in Sarge. If you don't have untrusted local users or you're not using mod_include you don't have to worry.

No.

[Tony-A]

As a rule, any program of reasonable complexity has bugs.
A possible exception exists for programs written by Knuth.

What is freakish is that Knuth is the only person with the ability and determination and discipline required to write a program without bugs.

Me I'd find some other term than "freakish", like phenominal, but the critical distinction is the same.

Re:What ever

[l3v1]

I just could not notice having become troll for that comment. Oh well, whatever you want guys. Thing is, I'm using Apache 1 and 2 versions on some linux and windows machines, some out on the web, some for local development, whatever. There are also some folks I know, who run linux and windows servers for db and web serving, 1&2 apache's mixed. But every commited one of them (which I am not, not having an admin job, and I wouldn't ever want one) never considered exposing an A2 server out to the large scale public (just remember A2 and PHP thread problems, module migration problems - maybe these or not such a problem anymore, the shadows still lurk). Call them (or me) freaking FUD spreaders, it's just our way.

So we're the bad guys, stupid guys, whatever (like I care), and we're not worth talking about Apache, we poor schmucks. But you guys, who raise A2 into the clouds of Olympus, you rock, 'cause you know the truth.

For the typo: well, that's still just me.

Re:Apache is awful.

[LardBrattish]

Why Firebird? I've used it enough to still call it "Interbastard". I would have thought PostGreSQL would have been a better choice but give me a month until I've had it running a while on my home server then I'll tell you what name I've come up with for it ;)

Re:Apache is awful.

[llefler]

I wouldn't mind Postgresql, but it has a very annoying feature that I can't tolerate. Let me preface this by saying I work with a lot of legacy MS-SQL TransactSQL. MS-SQL can be configured (default) to NOT be case sensitive in any way, shape, or form. If I create a table called MyTable, I can address it any way I like and I will get results. Same goes for fields. The only effect is that if I do a straight dump of a result set, my fields will be called DailySales, not dailysales or DAILYSALES. So I don't have to reformat them for the users. Now, a lot of this legacy SQL and table structures took that into account.

If I try to use that with Postgresql, I have to put "every statement" inside "double quotes" so it doesn't "lowercase every freaking field and table". Case sensitivity is fine, but evaluate statements as I enter them. If they insist on lowercasing everything I don't put in quotes, lowercase the SQL server side of the comparison too.

MySQL isn't an option for me. What good is a database server that doesn't return errors on validation failures. But I can live with Firebird now that they have the super server. It, or FlameRobin/IBAccess, lowercase all of my table and field names, but I can live with that.

And yeah, in the past I wasn't all that impressed with Interbase either. I've always used ClientDatasets to avoid it until recently. My complaint has always been a lack of decent tools and it's bizarre desire to expect the client to know the location of it's GDB files.

support

[torrents]

does anybody know off hand how long they will contunue to support apache 1.x

first post!

[Comrade_X]

omg I got first post!

Re:first post!

[josmum]

you will soon know the secret phallus.