Jump to content
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble

MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, register and become a site sponsor/subscriber and ads will be disabled automatically. 

Sign in to follow this  

Flaw Found in Apache HTTP Server

Recommended Posts

A buffer overrun vulnerability in the Apache HTTP server included with many popular Web servers enables an attacker to execute code on vulnerable machines.

The flaw lies in the way that the server handles data transmissions of unknown size. Typically, these transmissions are broken into "chunks" for easier handling. But Apache's HTTP server misinterprets the size of the chunks, which leads to an overrun of the heap memory, according to an advisory published Monday by Internet Security Systems Inc.'s X-Force research team.

The vulnerability can be exploited remotely by way of a carefully crafted invalid request to the server, and the flawed functionality is enabled by default. Exploiting the flaw could either lead to a denial of service on the machine or the execution of malicious code.

The Apache Software Foundation's Apache Server Project, which maintains the open-source HTTP server, also issued a bulletin warning that all versions of Apache 1.3 are vulnerable, as are copies of version 2 up to 2.0.39.

However, versions 2.0 and later are not vulnerable to the remote execution of code, Apache's advisory said.

Apache is by far the most widely deployed Web server on the Internet, running on more than 50 percent of machines surveyed by Netcraft Ltd. Its HTTP server is included in products such as Oracle Corp.'s 9i Application Server and IBM Corp.'s WebSphere.

The Foundation said it was forced to release its advisory early—and without an available patch—because of ISS' decision to publish its bulletin.

Thanks to Neowin

More Info : EWeek

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.