For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Update: Apache users urged to upgrade to fix security flaws
or
Other Linux and Unix Stories
|
|
|
|
June 18, 2002 (Computerworld) -- The creators of Apache Web Server software said today that all Apache users are potentially affected by security vulnerabilities that were announced yesterday, even as a controversy continues about how the flaws were initially made public (see story).
Mark Cox, a founding member of The Apache Software Foundation, said the vulnerability is caused by a stack buffer overflow, which can overload a server with a distributed denial-of-service attack and cause it to stop responding. In some cases, most notably where Microsoft Windows servers are running the older Apache Version 1.3 or under some 64-bit Unix operating systems, the flaw could be more serious, potentially allowing an intruder to gain remote access to the server, Cox said. All Apache Web server installs should be upgraded to be safe, he said. The Apache foundation said users should keep checking its Web site for the updated code.
Those problems, reported in a bulletin late yesterday by the Apache HTTP Server Project, are in contrast to a report earlier in the day from security vendor Internet Security Systems Inc. (ISS) in Atlanta. The Apache HTTP Server Project is the open-source community that created and maintains Apache.
ISS said the vulnerability affects only Windows versions of Apache and was caused by a flawed mechanism used to calculate the size of "chunked" encoding for Windows 32-bit users. Chunked encoding is part of the HTTP Protocol Specification used for accepting data from Web users, according to ISS. The flaw, affecting Apache Versions 1.x, misinterprets the size of incoming data chunks, which could lead to a signal race, heap overflow and exploitation of malicious code, according to ISS.
Cox said that although ISS researchers correctly found part of the problem, they failed to see the whole picture before issuing their own security alert about the vulnerability. As a result, a patch that was also posted by ISS failed to fully fix the problem, he said. "The ISS guys, in their haste, didn't notice all of [the vulnerabilities]," Cox said.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
Download this Technology Briefing now!
Long Tail Supplier Collaboration - What's In It For You? 
Download this white paper, free, compliments of Citrix. - DNS hole prompts synchronized patching effort by IT vendors
- Microsoft plugs nine holes in Windows, DNS, SQL
- Symantec warns of new Word attack
- More top stories
| HP StorageWorks EVA4400 Before now, midsize customers settled for either an expensive and complex array or low cost solution that lacked functionality. Now experience virtual storage with enterprise class functionality at an affordable price. View this product demo now
|
|
|
