Use of an Unsecured Apache Version
Description of Identified Vulnerability:
Vulnerability Description: The current version of the Apache HTTP server installed contains several known security vulnerabilities. There are several flaws in this version due to a lack of bounds checking by the software, leading to a buffer overflow condition. The problem is reported to exist in the mod_ssl, mod_alias and mod_rewrite modules when a regular expression is configured with more the 9 captures using parenthesis. A malicious attacker could exploit these vulnerabilities thus obtaining unauthorised access to the servers.
Risk Level: High
A malicious user exploiting the security vulnerabilities of the current Apache HTTP server could gain unauthorised access to the server, thus an attacker may gain access to the contents of sensitive system files, execution files and even gain full control over the system. The Apache Group is aware of the security vulnerabilities that exist on this version and repairs are available on the project’s site.
Initial Recommendations:
? Upgrade to mod_ssl version 2.8.19 or newer and Apache to version 2.8.18 (Apache 1.3) or to Apache 2.0.50
—
Where can we download mod_ssl version 2.8.19?
Where can we download Apache 2.0.50?