Admin
Deleted
May 29, 2004, 12:51 PM
Post #1 of 8
(3087 views)
Shortcut
|
|
Scheduled Downtime For Apache Upgrade -- Security Vulnerability Issues
|
Can't Post
|
|
Hi.
We shall be scheduling a webserver upgrade of about 60 minutes for upgrading the Web Server software to the latest version Apache 1.3.31 from the current 1.3.29. Of particular note is that 1.3.31 addresses and fixes the following 4 security related issues:
In mod_digest, verify whether the nonce returned in the client response. This problem does not affect mod_auth_digest.
[CAN-2003-0987 (cve.mitre.org)]
Escape arbitrary data before writing into the errorlog.
[CAN-2003-0020 (cve.mitre.org)]
Fix starvation issue on listening sockets where a short-lived connection on a rarely-accessed listening socket will cause a child to hold the accept mutex and block out new connections until another connection arrives on that rarely-accessed listening socket.
[CAN-2004-0174 (cve.mitre.org)]
Fix parsing of Allow/Deny rules using IP addresses without a netmask; issue is only known to affect big-endian 64-bit platforms
[CAN-2003-0993 (cve.mitre.org)]
The upgrade shall be starting at 01:00 Hrs. Though we would not be taking anything offline, but it could be that during the upgrade run, certain things may not be accessible. The maximum duration is scheduled to be about 60 minutes from 01:00 Hrs on 31st May 2004. This would also involve retuning certain aspects which control the webmail, directory and forum software. This is just a security update. This is for information to all our clients.
Cheers
Admin
Scorpio Informatics
(This post was edited by Admin on Jun 6, 2004, 8:47 PM)
|
Main 
Search Posts
WHO'S Online
LOG 