Subject: apache core

From: Lance Uyehara <[email-masked]>
Date: Wed, 16 Oct 2002 12:41:31 -0700

I am running apache 1.3.22 and mod_ssl-2.8.5-1.3.22, and have had a few 
cores recently. They all have the same backtrace:

(gdb) whe
#0  0x28158f57 in ssl3_write_bytes () from /usr/lib/libssl.so.2
#1  0x28158e68 in ssl3_write_bytes () from /usr/lib/libssl.so.2
#2  0x28158b58 in ssl3_write_bytes () from /usr/lib/libssl.so.2
#3  0x2815a641 in ssl3_write () from /usr/lib/libssl.so.2
#4  0x28156698 in SSL_write () from /usr/lib/libssl.so.2
#5  0x80839bf in SSL_writev ()
#6  0x80838b0 in ssl_io_hook_writev ()
#7  0x80e1517 in ap_hook_call_func ()
#8  0x80e0c28 in ap_hook_call ()
#9  0x80bd16c in writev_it_all ()
#10 0x80bd5c3 in large_write ()
#11 0x80bd697 in ap_bwrite ()
#12 0x80d012f in ap_send_mmap ()
#13 0x80c6212 in default_handler ()
#14 0x80be9c8 in ap_invoke_handler ()
#15 0x80d37ac in process_request_internal ()
#16 0x80d3816 in ap_process_request ()
#17 0x80ca6af in child_main ()
#18 0x80ca958 in make_child ()
#19 0x80cacdc in perform_idle_server_maintenance ()
#20 0x80cb259 in standalone_main ()
#21 0x80cb8a4 in main ()
#22 0x805a549 in _start ()

I don't have symbols so it's a little hard for me to see what's happening, 
but I thought I'd see if this is a known issue.

I've tried to recompile my httpd with symbols but when I do that and run 
"gdb httpd <corefile>" the backtrace seems to change. I don't think that's 
normal, so I suspect I'm doing something wrong.

Any help in tracking this down is appreciated.

Thanks,
-Lance

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Cliff Woolley <[email-masked]>
Date: Wed, 16 Oct 2002 15:50:16 -0400 (EDT)

> cores recently. They all have the same backtrace:

You're probably being probed by the openssl worm.  You need to upgrade to
all the latest versions, as there are a number of remotely exploitable
flaws in the versions you have.

--Cliff

---

From: Lance Uyehara <[email-masked]>
Date: Wed, 16 Oct 2002 13:13:52 -0700

>flaws in the versions you have.

Thanks! I really appreciate the quick response.

-Lance