Apache Week issue 301

                                APACHE WEEK
                                      
The essential weekly guide for users of the world's most popular Web server.
                          Issue 301: 5th July 2002
                                      
                                 In this issue
                                       
     * Under development
     * In the news
     * Featured articles
     * Apache Week 300 giveaway
       
                               Under development
                                       
     Apache 2.0 performance was again the hot topic on the development
     list this week as some detailed results of profiling httpd on AIX
     were sent in by IBM hacker Bill Stoddard. Several areas of code
     were targetted for optimisation after some analysis of the results;
     of particular note was the request header parsing loops which
     copied input data and used several temporary memory allocations.
     The discussion led to several optimisations being checked-in, with
     more pending.
     
     One of the changes included in Apache 1.3.26 has caused a few
     surprises as parsing of the HTTP request line in Apache has become
     stricter; now rejecting some illegal requests which earlier
     versions accepted. Any client applications which were generating
     illegal request lines and getting away with it will find that when
     taking to Apache 1.3.26 a 400 Illegal Request error response will
     be returned. An example of an illegal request line would be to
     include an unescaped space character in the URI. Consensus on the
     list was that the code should be reverted to the previous
     behaviour, following the IETF maxim: "be liberal in what you
     accept".
     
     Those of you who prefer tinkering with Apache to playing the latest
     Playstation game may be interested in Chris Taylor's
     [1]announcement of a binary build of Apache 2.0.39 for PS/2 Linux
     installations.
     
                                  In the news
                                       
     [2]Two weeks ago we covered the details of the Chunked encoding
     vulnerability. This vulnerability allows a remote attacker to run
     arbitrary code on your server depending on your platform. The
     Common Vulnerabilities and Exposures project (cve.mitre.org) has
     assigned the name [3]CAN-2002-0392 to this issue.
     
     We strongly suggest that all users of Apache update their
     distributions to 1.3.26 or 2.0.39 or [4]apply this patch to
     existing installations.
     
     Over the last week various reports about an "Apache Worm" have
     surfaced. The worm currently seems to be fairly benign, focussing
     its attention on some FreeBSD systems only. Here are some of the
     news articles that covered the Apache worm:
     * [5]"New Apache worm starts to spread" by Robert Lemos at CNET
       News.com
     * [6]"Worm Exploits Apache Flaw" by Michael Chait at
       InternetNews.com
     * [7]"Apache worm picks up first scalp" by James Middleton at
       vnunet.com
     * [8]"Apache worm barely squirms" by Robert Lemos at CNET News.com
     * [9]"Worm exploits Apache vulnerability on FreeBSD" at
       ComputerWeekly CW360
     * [10]"Apache worm loose on the Net" at smh.com.au (The Sydney
       Morning Herald)
     * [11]"IIS and Apache flaws leave web wide open" by Rene Millman at
       vnunet.com
     * [12]"How we could have prevented an Apache worm" by Robert Vamosi
       at ZDNet Reviews
     * [13]"Apache worm spotted on real-time honeypot systems" by Domas
       Mituzas
       
                               Featured articles
                                       
     In this section we highlight some of the articles on the web that
     are of interest to Apache users.
     
     Web Developer's Virtual Library provides chapter 6 ("Security and
     users") of the book, "Web Development with Apache and Perl" by Theo
     Petersen in a few online installments for your perusal. [14]Part I
     covers the basics of Secure Sockets Layer (SSL) and certificates,
     the steps to install OpenSSL and mod_ssl with Apache, and the steps
     to configure and test that your SSL-enabled Apache is working. Then
     [15]Part II continues with setting up user authentication, and
     writing your own login page. There are still two more subsections
     on user management and login sessions to go before wrapping up this
     chapter.
     
     Other reviews on the above book are available at [16]Linux Journal,
     [17]Perl Monks, and [18]MetroWest Perl Mongers. Interested to read
     more? Then you can download two sample chapters from its
     [19]companion website.
     
                           Apache Week 300 giveaway
                                       
     Our colleagues at Wrox Press have given us two copies of their book
     "Professional Apache 2.0" to give away.
     
     Written by Apache Week reader and space tourism evangelist Peter
     Wainwright, the book covers all aspects of serving web sites using
     the Apache 2.0 web server. Read our [20]comprehensive review all
     about it.
     
     If you have not already entered for a chance to get your hands a
     copy of the book, answer this simple question:
     
     Which one of the following is the name of the security group that
     posted the first working exploit for the Apache chunked encoding
     vulnerability?
     A) GRUMBLES, B) GOBBLES, or C) GURGLES
     
     Send your answer to [21][email protected] to reach us no later
     than July 10th 2002. Your email address will not be used for
     anything other than to let you know if you are a lucky winner. Two
     winners will be drawn at random from all correct entries submitted,
     One entry per person, no cash alternative.
       ______________________________________________________________
     
     This issue brought to you by: Mark J Cox, Joe Orton, Min Min Tsan
     Comments or criticisms? Please email us at
     [22][email protected].
     
     [23]Apache Week is copyright 1996-2002 by [24]Red Hat, Inc.

References

   1. http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=102564231701925&q=raw
   2. http://www.apacheweek.com/issues/02-06-21#security
   3. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0392
   4. http://www.apache.org/dist/httpd/patches/apply_to_1.3.22/SECURITY_chunk_size_patch.txt
   5. http://news.com.com/2100-1001-940585.html
   6. http://www.internetnews.com/dev-news/article.php/1379361
   7. http://www.vnunet.com/News/1133123
   8. http://news.com.com/2100-1001-940989.html
   9. http://c.moreover.com/click/here.pl?r41697524
  10. http://www.smh.com.au/articles/2002/07/02/1023864727580.html
  11. http://www.vnunet.com/News/1133151
  12. http://www.zdnet.com/anchordesk/stories/story/0,10738,2873254,00.html
  13. http://dammit.lt/apache-worm/
  14. http://wdvl.internet.com/Authoring/Languages/Perl/Apache_Perl/
  15. http://wdvl.internet.com/Authoring/Languages/Perl/Apache_Perl/apache_perl2_1.html
  16. http://www.linuxjournal.com/article.php?sid=6122
  17. http://www.perlmonks.org/index.pl?node_id=171862
  18. http://metrowest.pm.org/WebDevelApachePerl.html
  19. http://www.manning.com/getpage.html?project=petersen&filename=chapters.html
  20. http://www.apacheweek.com/features/book-proapache2
  21. mailto:[email protected]
  22. mailto:[email protected]
  23. http://www.apacheweek.com/
  24. http://www.redhat.com/

----------------------------------------------------------------------
To unsubscribe: https://listman.redhat.com/mailman/listinfo/apacheweek
or send the message   "unsubscribe"  to  [email protected]
----------------------------------------------------------------------