De mensen achter Apache hebben een nieuwe versie uitgebracht van de HTTP-server. De 1.3.29-update haalt de bug uit de code die ervoor zorgt dat mod_alias en mod_rewrite gevoelig zijn voor een buffer overflow. Daarnaast zijn er drie andere bugs opgelost en een nieuwe feature toegevoegd. Het changelog ziet er als volgt uit:
Apache 1.3.29 Major changesSecurity vulnerabilities
The main security vulnerabilities addressed in 1.3.29 are:New features
- CAN-2003-0542 (cve.mitre.org): Fix buffer overflows in mod_alias and mod_rewrite which occurred if one configured a regular expression with more than 9 captures.
New features that relate to specific platforms:Bugs fixed
- Enabled RFC1413 ident functionality for both Win32 and NetWare platforms. This also included an alternate thread safe implementation of the socket timout functionality when querying the identd daemon.
The following bugs were found in Apache 1.3.28 (or earlier) and have been fixed in Apache 1.3.29:[break]Apache 1.3.29 is beschikbaar voor de volgende besturingssystemen:
- Within ap_bclose(), ap_pclosesocket() is now called consistently for sockets and ap_pclosef() for files. Also, closesocket() is used consistenly to close socket fd's. The previous confusion between socket and file fd's would cause problems with some applications now that we proactively close fd's to prevent leakage. PR 22805.
- Fixed mod_usertrack to not get false positive matches on the user-tracking cookie's name. PR 16661.
- Prevent creation of subprocess Zombies when using CGI wrappers such as suEXEC and cgiwrap. PR 21737.
MacOS X Darwin
:strip_exif()/i/1248859594.gif?f=thumbmedium)
:strip_icc():strip_exif()/u/36974/crop5e6ff4f7790f3_cropped.jpeg?f=community){kind=small}
