Web Analytics Made Easy -
StatCounter phpdev Apache and security? - CodingForum


No announcement yet.

phpdev Apache and security?

  • Filter
  • Time
  • Show
Clear All
new posts

  • phpdev Apache and security?

    Firepages, I hate to bring this up publicly, but it may be the best way to get the word out. Hopefully you can fix this and make a quickie release.

    Apparently, there has been a major denial-of-service attack hole discovered in Apache servers, both of the 1.x and 2.x varieties.

    There is an upgrade for Apache that fixes this problem.

    FP, is it practical to put together an emergency phpdev update that includes a properly configured Apache server to fix this problem? Your testbed server is popular enough to be listed via PHP.net, so maybe fixing this would be a Good Idea.
    "The first step to confirming there is a bug in someone else's work is confirming there are no bugs in your own."
    June 30, 2001
    author, ES-Membrane project (Github Pages site)
    author, Verbosio prototype XML Editor
    author, JavaScript Developer's Dictionary

  • #2

    Not a DoS problem, almost something Microsoft-esque actually, allowing you to run code at the level of Apache's user, which in Windows is bad, and in *nix can be a problem, but not as easily.


    • #3
      Hi, cheers Alex

      as it happens dev5 is just around the corner with 1.3.24 (now .26 ) & apaxhe2.0.36 (now .39) so I will not be doing anything as such about existing versions except send an advisory to those who choose to receive notification when downloading phpdev & I will put a note on the site as well.

      on windows unless you have MSVCC etc applying a patch is not an option and a full upgrade of the server is required.

      dev5 is structured differently in that it will be possible in the future to 'upgrade' rather than download everything and start again so issues like this should not be such a pain in the butt.

      As for the exploit itself... I have had a grope around and have yet to find an example of the exploit at kiddie level although I am sure it will turn up eventually - security-space reckon a couple of days for the pros
      resistance is...

      MVC is the current buzz in web application architectures. It comes from event-driven desktop application design and doesn't fit into web application design very well. But luckily nobody really knows what MVC means, so we can call our presentation layer separation mechanism MVC and move on. (Rasmus Lerdorf)