|
As part of a deliberate effort to be proactive about security updates, the
Apache Software Foundation on Wednesday released a new version open-source
Apache 2.0 HTTP Server to fix two potentially serious denial-of-service
(define) vulnerabilities.
The Foundation, which was burned in
the past when a high-risk exploit was released on security mailing lists
before a patch could be issued, released version 2.0.46 of the server on
Wednesday but is withholding details of the security holes until users can
apply the upgrade. IM at Work @ WEB 2.0 JOURNAL::
Weve seen holes by the same name patched repeatedly in other software only to There is also a DoS attack on the network component, says Morse.
http://www.web2journal.com/read/41364.htmHOME |
(Apache 2.0.46 is available for download here).
The ASF said Apache versions 2.0.37
through 2.0.45 can be caused to crash in certain circumstances through
mod_dav and possibly other mechanisms but no further details would be
provided until Friday May 30. SecurityFocus Bugtraq: By Thread::
advice on the Universal Plug-and-Play security hole Marc Maiffret (12/27/01) MSIE DoS Using javascript Tom Micklovitch (12/20/01)
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2001-12HOME |
Additionally, the Foundation said Apache versions 2.0.40 through 2.0.45
on Unix platforms were found to be vulnerable to a DoS attack on the basic
authentication module. "A bug in the configuration scripts caused the
apr_password_validate() function to be thread-unsafe on platforms with
crypt_r(), including AIX and Linux," Apache explained. The Hacker Voice Community Forums > RSS Feeds::
Mozilla plugs 10 security holes in Firefox (0 replies) Brief: Mac OS X first to fall (0 replies) Vuln: Apache Tomcat Requests Containing MS-DOS Device Names
http://forums.hackervoice.co.uk/lofiversion/index.php?f58-2100.htmlHOME |
The open source project, which is run by volunteers within the ASF, said
all versions of Apache 2.0 contain the thread-safety problem on platforms
with no crypt_r() and no thread-safe crypt(), such as Mac OS X and possibly
others.
Latest statistics from Netcraft show Apache dominating the Web server
market, with 63 percent, or 25 million sites, well ahead of server products
from Microsoft, Zeus and Sun Microsystems .
 Lindows.com Nabs New Customer in Japan
 Digitally Archiving the Universe | 
PRINT
Add to favorites