Sunday, May 16, 2021

Apache Fixes Bugs in Server Upgrade

The Apache Software Foundation and The Apache Server Project on Thursday
released Version 1.3.27 of its popular Web server software, an upgrade that
includes fixes to three security vulnerabilities.

The new Apache HTTP server (download new version here) was
described as principally a security and bug-fix release. It plugs a hole
that exists in all versionsof Apache prior to 1.3.27 on platforms using
System V shared memory based scoreboards.

That vulnerability allows an attacker to execute code under the Apache UID
to exploit the Apache shared memory scoreboard format and send a signal to
any process as root or cause a local denial-of-service attack.

Another bug that made Apache susceptible to a cross site scripting
vulnerability in the default 404 page of any Web server hosted on a domain
that allows wildcard DNS lookups was also secure.

The Apache Foundation said some possible overflows in ab.c, which could be
exploited by a malicious server, were also fixed.

The new server release also includes new features that offer “substantial
improvements” over version 1.2, the Apache Foundation said, upgrades that
include better performance, reliability and an expansion of supported
platforms, including Windows NT and 2000 (which fall under the “Win32”
label), OS2, Netware, and TPE threaded platforms.

It has been fitted with a new ErrorHeader directive and configuration file
globbing that can now use simple pattern matching. Apache has also made the
protocol version (eg: HTTP/1.1) in the request line parsing
case-insensitive, a key upgrade over previous versions.

Other highlights include:

  • ap_snprintf() can now distinguish between an output which was
    truncated, and an output which exactly filled the buffer.
  • Add ProtocolReqCheck directive, which determines if Apache will check
    for a valid protocol string in the request (eg: HTTP/1.1) and return
    HTTP_BAD_REQUEST if not valid. Versions of Apache prior to 1.3.26 would
    silently ignore bad protocol strings, but 1.3.26 included a more strict
    check. This makes it runtime configurable.
  • Added support for Berkeley-DB/4.x to mod_auth_db.
  • httpd -V will now also print out the compile time defined
    HARD_SERVER_LIMIT value.
  • On specific platforms, new features in the upgrade include support for
    Caldera OpenUNIX 8 and the ability to use SysV semaphores by default on
    OpenBSD. It also implements file locking in mod_rewrite for the NetWare
    CLib platform.

    The Foundation said several minor bugs found in Apache 1.3.26 (or earlier),
    including mod_proxy fixes, have been included in Apache 1.3.27.

    Separately, the Jakarta Ant-Dev has released Version 1.5.1 of Apache Ant, a
    Java-based build tool that allows full portability of pure Java code. (Download
    new version here
    . The Jakarta Ant-Dev upgrade also fixes several bugs in
    older versions.

    Similar articles

    Latest Articles

    How IBM has Changed...

    Think is IBM’s big annual conference, and again this year, it was digital. I’m noticing a sharp quality difference in shows like this where...

    Database-Tuning Platform Launches and...

    PITTSBURGH — A team out of Carnegie Mellon University is launching its automatic database-tuning product today with the help of $2.5 million in funding.   OtterTune,...

    Top 10 Professional Services...

    Professional services automation (PSA) software aims to offer service-based companies most of the software they will need to run their businesses in one package....

    What is Data Aggregation?

    Data aggregation is the process where raw data is gathered and presented in a summarized format for statistical analysis. The data may be gathered...