Apache flaw leaves server wide open

Not much information is available about this threat yet, but Apache.org promises more details later. Here is Apache's official disclosure of this threat. The most detailed information has been provided by the discoverer, Auriemma Luigi, a researcher who works for PivX Solutions. The Mitre vulnerability designation is CAN-2002-0661, and it is described there as a "directory transversal vulnerability." The Mitre CVE List provides a standard way of designating and naming vulnerabilities so everyone knows which threat is being discussed. Mitre lists the following references for the threat:

Final word
This is a serious flaw, but Apache.org was right on top of the problem. The people who discovered this vulnerability, Newport Beach, CA-based PivX Solutions, reported it to Apache.org and began working with Apache on Aug. 7, according to the PC World story. The actual upgrade was made available on Aug. 16 in conjunction with the announcement of the discovery. Apache.org acted quickly, but no one can fix such problems instantly. All it can do is work with responsible companies that uncover such threats and attempt to coordinate the announcement with the release of the patch or update. Apache.org reacted quickly and PivX Solutions acted responsibly in delaying its announcement until a new version of Apache was available. PivX also discovered another minor flaw, one that could lead to the disclosure of some relatively unimportant server owner information, but this is also fixed in the latest Apache release. One word of caution: Whenever people see that Windows systems are vulnerable to some flaw and Linux/UNIX isn't, they tend to skip over the details if they run Linux and/or UNIX. In this case, the problem has nothing directly to do with Windows code, and this vulnerability is not limited to Windows-based systems but also applies to NetWare and OS/2 platforms. It isn't a threat due to a fault in Windows code; rather, the problem lies in the fact that the backslash character isn't properly checked as a bad char in the Windows version of Apache. And while Apache.org says that it believes the UNIX versions aren't affected, you should still keep an eye on this threat for a week or two for any updates, and perhaps even consider updating Linux/UNIX systems to the latest Apache release.

Have your say instantly in the
Tech Update forum. Find out what's where in the new Tech Update with our
Guided Tour. Let the editors know what you think in the
Mailroom.

« Previous
1
2
Next »

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

> I'm told it's somewhat annoying when people have their Macs stolen > and Apple stores treat the thief as the owner, but there you go. Ouch,...

14 minutes ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

@kevinmchapman. OK, I acknowledge that 'most' was a gratuitous throwaway comment as an afterthought and too presumptuous. As to proof, as you...

5 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

@BrownieBoy > Works really well for thieves.... >> Nice attempt to deflect the argument by tossing in a point that's totally >> irrelevant, even...

6 hours ago by Jack Schofield on AMD Ultrathins to challenge Intel Ultrabooks

fantastic that the so called piracy bills have been withdrawn. however, these anti-democracy supporters are still in the shadows so lets be alert...

7 hours ago by raskolnikof on SOPA, Protect IP support wavers in face of online protest

Please God no; teach them anything you like - thinking rationally, the uses and misuses of data, what data is and what it's not - but leave the...

9 hours ago by Tony Douglas via Facebook on Kids are the future. Teach ’em to code.

@Jack, > Works really well for thieves.... Nice attempt to deflect the argument by tossing in a point that's totally irrelevant, even it were...

23 hours ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

Make that 13 people now - I got refused today at Manchester airport. I thought I was up to date on this legislation - I knew of the EU ruling from...

1 day ago by bootlegger on UK airport body scans will not be opt out

Don't forget to check out apps like GoodReader or SlideShark either, they're indispensible for people on the go in presentation situations. Best...

1 day ago by tinycg on Four top iPad apps for people on the move

Well it seems there is something a number of us agree on. Why is the Ubuntu Unity launcher so ugly? I thought perhaps it was something to do with...

1 day ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint

Duplicate comments are not made intentionally. Its very good to know that now you are keeping check on this problem because sometimes a commenter...

2 days ago by Freebies202 on Microsoft fixes blog comments, speeds up blogs with open source

"the very significant number of users" and "many (most) of us" - you have no evidence for these statements. It is a fact that most users are saying...

2 days ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint