Hello and welcome to our community! Is this your first visit?
Enjoy an ad free experience by logging in. Not a member yet? Register.
Results 1 to 3 of 3
  1. #1
    Join Date
    May 2002
    Hayward, CA
    Thanked 24 Times in 22 Posts

    Exclamation phpdev Apache and security?

    Firepages, I hate to bring this up publicly, but it may be the best way to get the word out. Hopefully you can fix this and make a quickie release.

    Apparently, there has been a major denial-of-service attack hole discovered in Apache servers, both of the 1.x and 2.x varieties.

    There is an upgrade for Apache that fixes this problem.

    FP, is it practical to put together an emergency phpdev update that includes a properly configured Apache server to fix this problem? Your testbed server is popular enough to be listed via PHP.net, so maybe fixing this would be a Good Idea.
    "The first step to confirming there is a bug in someone else's work is confirming there are no bugs in your own."
    June 30, 2001
    author, ES7-Membrane project (Github Pages site)
    author, Verbosio prototype XML Editor
    author, JavaScript Developer's Dictionary

  2. #2
    Senior Coder jkd's Avatar
    Join Date
    May 2002
    metro DC
    Thanked 18 Times in 18 Posts

    Not a DoS problem, almost something Microsoft-esque actually, allowing you to run code at the level of Apache's user, which in Windows is bad, and in *nix can be a problem, but not as easily.

  3. #3
    Super Moderator
    Join Date
    May 2002
    Perth Australia
    Thanked 110 Times in 108 Posts
    Hi, cheers Alex

    as it happens dev5 is just around the corner with 1.3.24 (now .26 ) & apaxhe2.0.36 (now .39) so I will not be doing anything as such about existing versions except send an advisory to those who choose to receive notification when downloading phpdev & I will put a note on the site as well.

    on windows unless you have MSVCC etc applying a patch is not an option and a full upgrade of the server is required.

    dev5 is structured differently in that it will be possible in the future to 'upgrade' rather than download everything and start again so issues like this should not be such a pain in the butt.

    As for the exploit itself... I have had a grope around and have yet to find an example of the exploit at kiddie level although I am sure it will turn up eventually - security-space reckon a couple of days for the pros
    resistance is...

    MVC is the current buzz in web application architectures. It comes from event-driven desktop application design and doesn't fit into web application design very well. But luckily nobody really knows what MVC means, so we can call our presentation layer separation mechanism MVC and move on. (Rasmus Lerdorf)


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts