IT Security & Network Security News & Reviews - eWeek



IT Security & Network Security News

Apache Fixes Flaw in Web Server


By: Dennis Fisher
2002-10-04
Article Rating:starstarstarstarstar / 0


There are  user comments on this IT Security & Network Security News & Reviews story.


Vulnerability lets local users terminate processes or launch denial-of-service attacks against the server.

A new vulnerability in the Apache Web server gives local users the ability to terminate processes or launch denial-of-service attacks against the server.

The Apache Software Foundation has released an updated version of the affected server. The new release, 1.3.27, fixes the problem.

The vulnerability is in the shared memory scoreboard, which is stored in a shared memory segment owned by the Apache server. Any user who can obtain execution permissions under the Apache UID can send signals to any process as root, and in most cases, terminate the process, according to a bulletin published Thursday by iDefense Inc., a Chantilly, Va., security company.

Also, an attacker with the proper permissions could cause a denial-of-service condition on the Apache server.

IDefense said that is has been able to terminate arbitrary processes with this exploit, including some that terminated other users sessions.

The Apache 1.3.27 release also includes a fix for a cross-site scripting vulnerability present in the default error page for Apache 1.3x up to 1.3.26. When UseCanonicalName is off and support for wildcard DNS is present, the flaw allows remote attackers to execute script as other web page visitors via the Host: header.

The flaw also affects Apache 2.0 before 2.0.43.

The new versions of the Apache server are available at the Apache Web site.

Related Stories:

  • Bugbear Virus Still Running Wild
  • More Security Coverage






     
     
    >>> More IT Security & Network Security News & Reviews Articles          >>> More By Dennis Fisher
     


    • FEATURED SPONSOR VIDEOS

    Benefits of Workload Optimization

    What Smart Companies MUST Learn from Gaming

    Advances in Authentication

    Vertical Markets Benefit from Workload Optimization

    View More Videos

    Brought to you by
    Advertisement

    FEATURED SPONSOR MESSAGE

    Start the New Year with business intelligence—it’s a smart move

    Join us on February 1 for an encore rebroadcast at either 5 am or 12 noon EST and discover how business intelligence (BI) supports companies in uncertain business and economic climates. Get expert advice on how to create a strategy that fits your organization's needs and budget and see how quickly it can pay for itself.

    Click Here

    Brought to you by
    eweek digital

    Suggested Related Content:

    Articles Labs/How-To Multimedia


    Advertisement
     
    APPLY FOR A FREE 
    SUBSCRIPTION BELOW:
    >Try digital eWEEK
    >Renew today
    >Subscription help
    >More FREE Subscriptions
    First Name:Last Name:
    Title:Company:
    Address:City:
    State:Zip Code:
    Email:
    Issue Index | Contact Us | About | Advertise | Magazine Customer Service | Site Map
    eWEEK Quick LInks

    Security:
    Enterprise Networking
    Network Security
    Infrastructure Security
    How To: Data
    Security Watch Blog
    Storage:
    Data Storage
    Cloud Storage
    Storage Virtualization
    Network Access Storage
    How To: Storage
    Storage Station Blog
    Computing:
    Apple OSX
    Linux Systems
    Windows 7
    Managed Print Services
    Computer Reviews
    Microsoft Watch Blog
    Google Watch Blog
    Communications:
    VoIP Solutions
    Wireless Technology
    Messaging Software
    Web Services
    Apps & Development:
    Application Development
    Enterprise Apps
    Search Engines
    Database Software
    Web 2.0
    CIOs

    Vertical Markets:
    Federal Government IT
    Health Care IT
    Finance IT
    Mid-Market
    Channel and VARs
    Careers Blog
    More eWeek Links:
    Green Computing Center
    Tech Knowledge Center
    Tech Newsletters
    Tech RSS Feeds
    White Papers
    Tech Videos
    Magazine Subscriptions
    Enterprise Websites:
    ZDE Home
    eWeek
    Baseline Magazine
    Channel Insider
    CIO Insight
    eSeminars and Events
    Web Buyers Guide
    Developer Websites:
    DevSource C# and .Net
    Dev Shed
    DeveloperShed
    ASP Free
    SEO Chat
    Codewalkers
    Tutorialized
    Scripts.com
    Dev Mechanic
    Dev Articles
    Web Hosters
    Dev Hardware
    Technology Websites:
    Device Forge
    Desktop Linux
    Linux Devices
    Windows for Devices
    PDF Zone
    Linux Watch
    TechDirect
    Windows Migration
    Smarter Technology

    Use of this site is governed by our Terms of Use and Privacy Policy
    Copyright ©1996-2012 Ziff Davis Enterprise Holdings Inc. All Rights Reserved. eWEEK and Spencer F. Katt are trademarks of Ziff Davis Enterprise Holdings, Inc. Reproduction in whole or in part in any form or medium without express written permission of Ziff Davis Enterprise Inc. is prohibited.
    ZDE Cluster 3