ihr seid ja voll blöde

[Christian Kruse]

Hallo,

ihr habt immer noch den apache 1.3.26 auf eurem webserver ihr solltet doch wissen dass der
eine sicherheitslücke hat und durch den 1.3.27 ersetzt werden sollte!!!!!!

Dann wollma doch mal sehen:

• CAN-2002-0839 (cve.mitre.org): A vulnerability exists in all versions of Apache prior to
    1.3.27 on platforms using System V shared memory based scoreboards.

Wir haben kein SystemV.

• CAN-2002-0840 (cve.mitre.org): Apache is susceptible to a cross site scripting vulnerability
    in the default 404 page of any web server hosted on a domain that allows wildcard DNS
    lookups.

Wir benutzen die Default-404-Seiten nicht.

• CAN-2002-0843 (cve.mitre.org): There were some possible overflows in ab.c which could be
    exploited by a malicious server. Note that this vulnerability is not in Apache itself, but
    rather one of the support programs bundled with Apache.

Betrifft 'ab', nicht den Apachen. Schaumer mal weiter:

• The new ErrorHeader directive has been added.

Brauchen wir nicht.

• Configuration file globbing can now use simple pattern matching.

Brauchen wir nicht.

• The protocol version (eg: HTTP/1.1) in the request line parsing is now case insensitive.

Irrelevant, hat keinerlei Prioritaet.

• ap_snprintf() can now distinguish between an output which was truncated, and an output
    which exactly filled the buffer.

Irrelevant fuer uns.

• Add ProtocolReqCheck directive, which determines if Apache will check for a valid
    protocol string in the request (eg: HTTP/1.1) and return HTTP_BAD_REQUEST if not valid.
    Versions of Apache prior to 1.3.26 would silently ignore bad protocol strings, but 1.3.26
    included a more strict check. This makes it runtime configurable.

Irrelevant.

• Added support for Berkeley-DB/4.x to mod_auth_db.

Benutzen wir nicht.

• httpd -V will now also print out the compile time defined HARD_SERVER_LIMIT value.

Irrelevant.

• Support Caldera OpenUNIX 8.

Haben wir nicht.

• Use SysV semaphores by default on OpenBSD.

Haben wir nicht.

• Implemented file locking in mod_rewrite for the NetWare CLib platform.

Haben wir nicht.

• mod_proxy fixes:

Wir benutzen kein mod_proxy.

• In 1.3.26, a null or all blank Content-Length field would be triggered as an error;
    previous versions would silently ignore this and assume 0. 1.3.27 restores this previous
    behavior.

Irrelevant.

• Win32: Fix one byte buffer overflow in ap_get_win32_interpreter when a CGI script's #!
    line does not contain a \r or \n (i.e. a line feed character) in the first 1023 bytes. The
    overflow is always a '\0' (string termination) character.

Wir haben kein Win32.

Fazit: ein Update waere ueberfluessiger Arbeitsaufwand.

Kopfschuettelnde Gruesse,
 CK