November 07, 2009
Apache Fixes Bugs in Server Upgrade
The Apache Software Foundation and The Apache Server Project on Thursday
released Version 1.3.27 of its popular Web server software, an upgrade that
includes fixes to three security vulnerabilities.
The new server release also includes new features that offer "substantial
improvements" over version 1.2, the Apache Foundation said, upgrades that
include better performance, reliability and an expansion of supported
platforms, including Windows NT and 2000 (which fall under the "Win32"
label), OS2, Netware, and TPE threaded platforms.
ap_snprintf() can now distinguish between an output which was
truncated, and an output which exactly filled the buffer.
Add ProtocolReqCheck directive, which determines if Apache will check
for a valid protocol string in the request (eg: HTTP/1.1) and return
HTTP_BAD_REQUEST if not valid. Versions of Apache prior to 1.3.26 would
silently ignore bad protocol strings, but 1.3.26 included a more strict
check. This makes it runtime configurable.
Added support for Berkeley-DB/4.x to mod_auth_db.
httpd -V will now also print out the compile time defined
HARD_SERVER_LIMIT value.
The new Apache HTTP server (download new version here) was described as principally a security and bug-fix release. It plugs a hole that exists in all versions of Apache prior to 1.3.27 on platforms using System V shared memory based scoreboards.
That vulnerability allows an attacker to execute code under the Apache UID to exploit the Apache shared memory scoreboard format and send a signal to any process as root or cause a local denial-of-service (define) attack.
Another bug that made Apache susceptible to a cross site scripting vulnerability in the default 404 page of any Web server hosted on a domain that allows wildcard DNS lookups was also secure.
The Apache Foundation said some possible overflows in ab.c, which could be exploited by a malicious server, were also fixed.
Digg
del.icio.us
Newsvine
Facebook
Google
LinkedIn
MySpace
Reddit
Slashdot
StumbleUpon
Technorati
Twitter
Windows Live
YahooBuzz
FriendFeedIt has been fitted with a new ErrorHeader directive and configuration file globbing that can now use simple pattern matching. Apache has also made the protocol version (eg: HTTP/1.1) in the request line parsing case-insensitive, a key upgrade over previous versions.
Other highlights include:
Related Articles
On specific platforms, new features in the upgrade include support for Caldera OpenUNIX 8 and the ability to use SysV semaphores by default on OpenBSD. It also implements file locking in mod_rewrite for the NetWare CLib platform.
The Foundation said several minor bugs found in Apache 1.3.26 (or earlier), including mod_proxy fixes, have been included in Apache 1.3.27.
Separately, the Jakarta Ant-Dev has released Version 1.5.1 of Apache Ant, a Java-based build tool that allows full portability of pure Java code. (Download new version here. The Jakarta Ant-Dev upgrade also fixes several bugs in older versions.
The decision to outsource some or all of your IT infrastructure support is one that shouldn't be taken lightly, or without a significant amount of due diligence. Mike Scheuerman takes a look at the options you have, the details you need to cover, and the pitfalls to watch for.
IT Offers
On the Forums
More IT Management
CIO Update
Datamation
eSecurity Planet
ITSMWatch
Intranet Journal
IT Career Planet
Project Manager Planet
Semantic Web
Datamation Definitions
CIO Update
Datamation
eSecurity Planet
ITSMWatch
Intranet Journal
IT Career Planet
Project Manager Planet
Semantic Web
Datamation Definitions
|
|
Legal Notices, Licensing, Reprints, Permissions, Privacy Policy.
Advertise | Newsletters | Shopping | E-mail Offers | Freelance Jobs 
