phpdev Apache and security?

Alex Vincent · 06-23-2002, 06:08 AM

Firepages, I hate to bring this up publicly, but it may be the best way to get the word out. Hopefully you can fix this and make a quickie release.

Apparently, there has been a major denial-of-service attack hole discovered in Apache servers, both of the 1.x and 2.x varieties.

There is an upgrade for Apache that fixes this problem.

FP, is it practical to put together an emergency phpdev update that includes a properly configured Apache server to fix this problem? Your testbed server is popular enough to be listed via PHP.net, so maybe fixing this would be a Good Idea.

jkd · 06-23-2002, 06:11 AM

http://httpd.apache.org/

Not a DoS problem, almost something Microsoft-esque actually, allowing you to run code at the level of Apache's user, which in Windows is bad, and in *nix can be a problem, but not as easily.

firepages · 06-24-2002, 03:54 AM

Hi, cheers Alex

as it happens dev5 is just around the corner with 1.3.24 (now .26

) & apaxhe2.0.36 (now .39) so I will not be doing anything as such about existing versions except send an advisory to those who choose to receive notification when downloading phpdev & I will put a note on the site as well.

on windows unless you have MSVCC etc applying a patch is not an option and a full upgrade of the server is required.

dev5 is structured differently in that it will be possible in the future to 'upgrade' rather than download everything and start again so issues like this should not be such a pain in the butt.

As for the exploit itself... I have had a grope around and have yet to find an example of the exploit at kiddie level although I am sure it will turn up eventually - security-space reckon a couple of days for the pros