Apache Closes Down Vulnerabilities
No less than five vulnerabilities were eradicated by the release of a new version of the Apache Web server.
Release 2.2.6 removes five partly critical security holes. Four of them are also closed by the latest 2.0 branch release, version 2.0.61. According to the Apache Foundation's release notes, vulnerabilities were removed in the "mod_proxy" and "mod_cache" modules. Attackers had previously been able to crash servers by targeted requests leading to a Denial-of-Service (DoS) attack.
A cross site scripting bug discovered by Stefan Esser – the initiator of the "Month of PHP Bugs" – is also a thing of the past. The fourth bug that affected both versions resulted in a DoS vulnerability in the Prefork-MPM module. The bug in the "mod_mem_cache" module only occurs in the 2.2 series. The vulnerability gave attackers the ability to read headers from prior connections in some circumstances.
The developers advise server administrators to switch to one of the new versions as soon as possible. The versions are available, as always, from the project's mirror servers. Besides fixing various vulnerabilities, the patches also include a number of bugfixes.
Issue 158/2014
Buy this issue as a PDF
Digital Issue: Price $9.99
(incl. VAT)
Tag Cloud
News
-
New Mint Minted
Version 16 of the popular Linux desktop reveals new tools, edge-snapping, and performance improvements.
-
New Worm Attacks Linux Devices
Symantec says Linux-Darlioz burrows in through PHP.
-
Project Sputnik Gets a Boost
Dell renews its quest for the ultimate developer machine.
-
Sneaky New Linux Attack Discovered in the Wild
Innovative back door looks like normal SSH traffic.
-
CeBIT Call for Papers
One of CeBITs most successful forums opens the new year with a new name. The popular Open Source Forum continues in 2014 under the name Special Conference: Open Source. This year, the forum will be bigger and offer a wider range of possibilities for sponsors.
-
Linus Announces Linux Kernel 3.12
New release offers better graphics drivers and expands filesystem support.
-
Dark Alliance Reinvents Email Security
New mail protocol will shut out the NSA and prevent snooping on metadata.
-
DDos Attack Map Charts Denial of Service
A new web application helps users visualize distributed denial-of-service attacks.
-
Saucy Salamander Gets Legs
Ubuntu 13.10 takes a step toward convergence, with lots of mobility, but Mir only partly here.
-
Intel and Arduino Create Pi-Like System
Galileo board is targeted to embedded developers and educational institutions.