Slashdot Mirror

← Back to Stories (view on slashdot.org)

Apache Request Smuggling Vulnerability Found

Posted by CowboyNeal on from the web-jacking dept.

An anonymous reader writes "Whitedust is reporting on a HTTP request smuggling vulnerability in Apache. The flaw apparently allows attackers to piggy back valid HTTP requests over the 'Content-Length:' header, which can result in cache poisoning, cross-site scripting, session hijacking and other various kinds of attack. This flaw affects most of the 2.0.x branch of Apache's HTTPD server."

6 of 168 comments (clear)

  1. Wait a sec.. by rylin · · Score: 5, Interesting

    1.3.x is very stable and production ready
    2.0.x is very stable and production ready, but it doesn't have the same amount of years on its neck as 1.3.x - and thus doesn't have as widespread deployment.
    2.1.x is alpha-quality, and it has the fix..

    messed up priorities?

    1. Re:Wait a sec.. by name773 · · Score: 2, Interesting

      maybe the 2.1 series had other code changes that made the fix easier to implement

  2. Re:Fix-patch in 5...4...3... by gomoX · · Score: 2, Interesting

    I hate to run your day you know, but that's why it's called Apache in the first place. It comes from the days where the Apache guys were heavily patching the NCSA webserver. Sorry :(

    Link

    --
    My english is sow-sow. Sowhat?
  3. Apache Vulnerability? by RAMMS+EIN · · Score: 2, Interesting

    To me it seems that this is mostly an attack on proxying servers, causing them to misbehave and send malicious requests to Apache (a bit similar to the old FTP PORT exploit). Then how is this a vulnerability in Apache, if it's the proxy that compromised, and Apache just handling what it thinks is a legitimate request?

    Or am I completely misunderstanding what's going on?

    --
    Please correct me if I got my facts wrong.
  4. Re:If you want to be secure... by -brazil- · · Score: 2, Interesting

    Eh? $99 gets you full root access on a dedicated server...you can upgrade what you like when you like. I don't see the problem.

    You said it yourself: you CAN upgrade what you like and when you like... which is "nothing" and "never" for most people who don't want to spend the time and effort required to react quickly to vulnerabilities as they are discovered.

    --

    The illegal we do immediately. The unconstitutional takes a little longer.
    --Henry Kissinger

  5. Re:Another Dupe by BillEGoat · · Score: 3, Interesting

    Apache admins who read the watchfire paper felt fairly safe as its technique only resulted in limited effects to Apache. The technique described simply used multiple Content-Length headers, which Apache effectively handled. This modified technique incorporates the use of chunked encoding to open Apache up to the wider effects that other servers experienced with the simpler exploit. After reading this, Apache admins should plot their upgrades in short order.