Apache Issues Fix For Win32, OS/2 bug

dthor writes "An exploit was discovered that allows a malicious user to terminate the Apache server 1.3.x running on Win32 or OS2. Apache has released a patch. 'Users of older versions of Apache on Win32 and OS2 platforms are cautioned to to upgrade to 1.3.19 and apply this fix. All Win32 and OS2 users are strongly encouraged to upgrade to 1.3.20 once it is released.'"

Re:HA! See?

[smooc]

OS = OpenSource

DUH!

Submitted that...

[Orbital Sander]

From my submit story page:

2001-05-22 17:58:16 Apache 1.3.20 Released (articles,apache) (rejected)

That was a week ago today... kinda disappointing. Do I get rejected because I post from MSIE on a Mac?

Re:HA! See?

[nirvdrum]

And what does a URI issue that attacks the server have to do with the OS? This kind of an attack is what gives IIS a bad name.

Re:Submitted that...

[wizzy403]

I did the same thing the day after you:

2001-05-23 18:31:39 Apache 1.3.20 is available (articles,apache) (rejected)

I'm guessing that someone was asleep at the switch and thought it had already been posted. *shrug*

Re:Submitted that...

[lmd]

I submitted this news just a few hours after he (Orbital Sander) posted it and before your post.

2001-05-22 21:49:22 Apache 1.3.20 is now available (articles,apache) (rejected)

Oh well. I hope they accept my post when Apache 2.0 (nonbeta) is available.

1.3.20

[green pizza]

1.3.20 has been out for what, 5 days already? Yeesh, look at the Freshmeat Slashbox from time to time.

Re:HA! See?

[ConsumedByTV]

Yea your right, but because its OS it got patched ASAP, no cover up, no stock holders to kiss ass to, just fixed the problem and didnt even have to fill a report.


The Lottery:

Re:1.3.20

[epicurus]

yeah, but the windoze binaries are always a few days (sometimes a week or more) behind in getting released...

Apache 1.3.20 is released

[geirt]

... users are strongly encouraged to upgrade to 1.3.20 once it is released.

Here [apache.org] is the Release Announcement for 1.3.20

The relevant part of the changelog:

* A carefully constructed URI could cause the server to segfault on Win32 and OS/2, denying access to users until the error was cleared. This is resolved on both platforms, no server data vulnerability was identified for this denial of service exploit.