Apache flaw leaves server wide open

Not much information is available about this threat yet, but Apache.org promises more details later. Here is Apache's official disclosure of this threat. The most detailed information has been provided by the discoverer, Auriemma Luigi, a researcher who works for PivX Solutions. The Mitre vulnerability designation is CAN-2002-0661, and it is described there as a "directory transversal vulnerability." The Mitre CVE List provides a standard way of designating and naming vulnerabilities so everyone knows which threat is being discussed. Mitre lists the following references for the threat:

Final word
This is a serious flaw, but Apache.org was right on top of the problem. The people who discovered this vulnerability, Newport Beach, CA-based PivX Solutions, reported it to Apache.org and began working with Apache on Aug. 7, according to the PC World story. The actual upgrade was made available on Aug. 16 in conjunction with the announcement of the discovery. Apache.org acted quickly, but no one can fix such problems instantly. All it can do is work with responsible companies that uncover such threats and attempt to coordinate the announcement with the release of the patch or update. Apache.org reacted quickly and PivX Solutions acted responsibly in delaying its announcement until a new version of Apache was available. PivX also discovered another minor flaw, one that could lead to the disclosure of some relatively unimportant server owner information, but this is also fixed in the latest Apache release. One word of caution: Whenever people see that Windows systems are vulnerable to some flaw and Linux/UNIX isn't, they tend to skip over the details if they run Linux and/or UNIX. In this case, the problem has nothing directly to do with Windows code, and this vulnerability is not limited to Windows-based systems but also applies to NetWare and OS/2 platforms. It isn't a threat due to a fault in Windows code; rather, the problem lies in the fact that the backslash character isn't properly checked as a bad char in the Windows version of Apache. And while Apache.org says that it believes the UNIX versions aren't affected, you should still keep an eye on this threat for a week or two for any updates, and perhaps even consider updating Linux/UNIX systems to the latest Apache release.

Have your say instantly in the
Tech Update forum. Find out what's where in the new Tech Update with our
Guided Tour. Let the editors know what you think in the
Mailroom.

« Previous
1
2
Next »

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

I also installed the KDE version; I also will probably try out razorqt since I really haven't had a chance to before. I'm looking forward to the...

1 hour ago by Thomas Gellhaus via Facebook on Mageia 2 Released

Acquiring when reinvention/cannibalization is too challenging for a large organization can be an excellent strategy- still, so many mergers stumble...

4 hours ago by francisabigail on Ariba buy parks SAP on Oracle's cloud turf

All of the feedback regarding using a touch monitor for a desktop PC is right on. Several months ago, we installed a "demo" multitouch all-in-one...

9 hours ago by apexwm on Windows 8 could speed multi-monitor uptake

anyone wanting to triple boot *their* own Mac

10 hours ago by 191706 on xTreme Triple Booting: Linux, Mac & Windows

Cont.. Biggest Bugbear: Win7's stop-animate-go approach to work, you develop a staggered (not in the above alchohol sense of the word) approach to...

10 hours ago by SoapyTablet on Windows 8 could speed multi-monitor uptake

Ah the joys of Windows 8 Consumer Preview... If Windows 7 was 'Vista with Lipstick', whats Windows 8? Vista with Lipstick, the morning after?...

10 hours ago by SoapyTablet on Windows 8 could speed multi-monitor uptake

Though the metro look is quite cool on the windows mobile platform I think that think that microsoft ARE MESSING THINGS UP because what has they...

11 hours ago by daveveej on Windows 8 could speed multi-monitor uptake

I agree, we have a few touch screen monitors in work but as Windows7 and the applications we use are not touch screen friendly (the size of the...

12 hours ago by Custonian on Windows 8 could speed multi-monitor uptake

I find it amusing that Microsoft added the mouse, which was deemed awkward, but people were forced to use it so it stuck, and now they're saying,...

14 hours ago by archerthom on Windows 8 could speed multi-monitor uptake

Agree with other comments. Nobody's going to start reaching out to start tapping their desktop monitors with their fingers. Their arms would tire...

23 hours ago by BrownieBoy on Windows 8 could speed multi-monitor uptake

The only way a touch monitor would be any good is if it were horizontal on the desk, with a virtual keyboard so you could do away with that as well...

1 day ago by Random_Error on Windows 8 could speed multi-monitor uptake

This is just dumb! Forget that I think Windows 8 will bomb, but really, people are going to go out and buy touch Monitors now??? Just pretend...

1 day ago by JBDragon on Windows 8 could speed multi-monitor uptake