Ready to be published? LXer is read by around 350,000 individuals each month, and is an excellent place for you to publish your ideas, thoughts, reviews, complaints, etc. Do you have something to say to the Linux community?
Linux and Unix vendors are releasing fixes for a critical bug in the popular Web server Apache that could allow attackers to crash the system or execute malicious code. The bug affects Apache 1.3.x installations configured to act as proxy servers, which relay requests between a Web browser and the Internet. When a vulnerable server connects to a malicious site, a specially-crafted packet can be used to exploit the vulnerability, according to security researcher Georgi Guninski, who has publicly released exploit code.
The headline makes it sound as if there has been some other recent "big holes" in Apache. The last one was in 2002, hardly recent. And then it only effects certain Apache versions in the 1.3.x range, and only if they are proxying requests to malicious sites. And then it will only be a denial of service type of problem, unless you are running it on BSD where it could possibly execute code.
I don't know but it doesn't seem like that big of a problem to me. Of course I am running all Apache 2.x servers these days so it doesn't effect me at all. In fact the only proxying I do with Apache is very limited and within the confines of a corporate intranet. I'm sure there are people out there who would be effected but I doubt a large percentage would be.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
I don't know but it doesn't seem like that big of a problem to me. Of course I am running all Apache 2.x servers these days so it doesn't effect me at all. In fact the only proxying I do with Apache is very limited and within the confines of a corporate intranet. I'm sure there are people out there who would be effected but I doubt a large percentage would be.