Subject: RE: Apache 2.039

From: "Gregg Andrew" <[email-masked]>
Date: Thu, 8 Aug 2002 13:50:34 -0400

Openssl.org version 0.9.6e
 
-----Original Message-----
From: Tony Jarriault [mailto:[email-masked]] 
Sent: Thursday, August 08, 2002 12:06 PM
To: [email-masked]
Subject: Apache 2.039
 
Hi,
 
I'm search openssl for Apache 2.039, where can i find it, please ?
 
Best Regards.

Tony Jarriault 
----------------------------------------------------------------------- 
Service webmaster : mailto:[email-masked] 
Tel : 01-34-49-06-69 
MGN : http://www.mgn.fr <http://www.mgn.fr/>  
-----------------------------------------------------------------------
Tony Jarriault 
mailto:[email-masked] 
Tel : 01-34-49-06-43 
MATRA GLOBAL NETSERVICES 
Societé du groupe PROSODIE 
8, rue Grange Dame Rose 
78140 Vélizy

---

From: [email-masked]
Date: Fri, 09 Aug 2002 09:38:52 +0800

> Openssl.org version 0.9.6e

Do you know what different between 0.9.6b and 0.9.6e, Because I knew
there are some of users they are using 0.9.6b, I think 0.9.6b is an
older version... But if I use the new version of Apache ( eg : 1.3.26 ),
so... use 0.9.6e is good ? I was fail to install 0.9.6d !

---

From: Cliff Woolley <[email-masked]>
Date: Thu, 8 Aug 2002 22:29:37 -0400 (EDT)

On Fri, 9 Aug 2002 [email-masked] wrote:

> Do you know what different between 0.9.6b and 0.9.6e

Among other things, there are important security fixes in 0.9.6e (for
remotely exploitable bugs in 0.9.6d and earlier versions).

Upgrade to 0.9.6e.

--Cliff

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: [email-masked]
Date: Fri, 09 Aug 2002 10:57:15 +0800

> remotely exploitable bugs in 0.9.6d and earlier versions).

So, do you agree compile and install apache 1.3.26, php 4.2.2, MySQL
3.23.51, OpenSSL 0.9.6e and mod_ssl 2.8.10-1.3.26 good for working
together under Linux / Unix / other OS System ?

Thank for your help !

---

From: Cliff Woolley <[email-masked]>
Date: Fri, 9 Aug 2002 10:27:15 -0400 (EDT)

> Upgrade to 0.9.6e.

Make that 0.9.6f, released today.  :)

--Cliff

---

From: Cliff Woolley <[email-masked]>
Date: Fri, 9 Aug 2002 10:28:44 -0400 (EDT)

> Make that 0.9.6f, released today.  :)

That's what I get for not reading all of my email before responding to
any of it.  0.9.6g was also released today.  Sigh.  :)

---

From: Maurizio Marini <[email-masked]>
Date: Fri, 9 Aug 2002 16:35:42 +0200

>Make that 0.9.6f, released today.  :)
 g, just a few minutes ago..

---

From: Cliff Woolley <[email-masked]>
Date: Fri, 9 Aug 2002 17:47:13 -0400 (EDT)

> any of it.  0.9.6g was also released today.  Sigh.  :)

I guess today was the day for releases.  Apache 2.0.40 is now out as well.

--Cliff

---

From: "R. DuFresne" <[email-masked]>
Date: Fri, 9 Aug 2002 18:55:01 -0400 (EDT)

> I guess today was the day for releases.  Apache 2.0.40 is now out as well.

Any word on if this compiles on those older linux kernels as the previous
release was a total dud in that realm?

Thanks,

Ron DuFresne
-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: "R. DuFresne" <[email-masked]>
Date: Fri, 9 Aug 2002 19:10:47 -0400 (EDT)

This is a security fix release for those using apache in Cygwin
environments!

<quote>

Date: Fri, 9 Aug 2002 22:07:52 +0100 (BST)
From: Mark J Cox <[email-masked]>
To: [email-masked],
     Full Disclosure <[email-masked]>,
     Vuln-Dev <[email-masked]>
Subject: [Full-Disclosure] Apache 2.0 vulnerability affects non-Unix
    platforms

-----BEGIN PGP SIGNED MESSAGE-----

For Immediate Disclosure

=============== SUMMARY ================

        Title: Apache 2.0 vulnerability affects non-Unix platforms
         Date: 9th August 2002
     Revision: 2
 Product Name: Apache HTTP server 2.0
  OS/Platform: Windows, OS2, Netware
Permanent URL:
http://httpd.apache.org/info/security_bulletin_20020809a.txt
  Vendor Name: Apache Software Foundation
   Vendor URL: http://httpd.apache.org/
      Affects: All Released versions of 2.0 through 2.0.39
     Fixed in: 2.0.40
  Identifiers: CAN-2002-0661

=============== DESCRIPTION ================
Apache is a powerful, full-featured, efficient, and freely-available Web
server.  On the 7th August 2002, The Apache Software Foundation was
notified of the discovery of a significant vulnerability, identified by
Auriemma Luigi <[email-masked]>.

This vulnerability has the potential to allow an attacker to inflict
serious damage to a server, and reveal sensitive data.  This vulnerability
affects default installations of the Apache web server.

Unix and other variant platforms appear unaffected.  Cygwin users are
likely to be affected.

=============== SOLUTION ================

A simple one line workaround in the httpd.conf file will close the
vulnerability.  Prior to the first 'Alias' or 'Redirect' directive, add
the following directive to the global server configuration:

   RedirectMatch 400 "\\\.\."

Fixes for this vulnerability are also included in Apache HTTP server
version 2.0.40.  The 2.0.40 release also contains fixes for two minor
path-revealing exposures.  This release of Apache is available at
http://www.apache.org/dist/httpd/

</quote and SNIP>

Thanks,

Ron DuFresne

---

From: Cliff Woolley <[email-masked]>
Date: Fri, 9 Aug 2002 23:05:36 -0400 (EDT)

> release was a total dud in that realm?

Probably no change.  But FWIW, I believe one of our developers tried it on
an older kernel and it worked fine for him....... if you could provide
access to a box it fails on to one of the core dev team, that might help.

--Cliff

---

From: Mads Toftum <[email-masked]>
Date: Sat, 10 Aug 2002 11:24:58 +0200

> release was a total dud in that realm?

I've compiled Apache2 on a 2.0 linux kernel several times without problems.

vh

Mads Toftum
-- 
`Darn it, who spiked my coffee with water?!' - lwall

---

From: "R. DuFresne" <[email-masked]>
Date: Sat, 10 Aug 2002 05:34:44 -0400 (EDT)

> I've compiled Apache2 on a 2.0 linux kernel several times without problems.

yes, but, on an older linux kernel?  Pre 2.2.x?

Thanks,

Ron DuFresne

---

From: "Imran Badr" <[email-masked]>
Date: Wed, 14 Aug 2002 16:01:07 -0700

I am using modssl 2.8.3-1.3.19. I define 14 virtual SSL servers in the
apache config file. If for example, openssl returns an error in SSL_CTX
initialization for 7th (or any) virtual server then all the previous SSL_CTX
structures are not free'd. Nobody calls SSL_CTX_free() for previous
allocated SSL contexts.

Imran.