Apache Week issue 325

                                APACHE WEEK

The essential weekly guide for users of the world's most popular Web server.
                         Issue 325: 11th April 2003

                                 In this issue

     * Under development
     * Security Reports
     * Featured articles

                               Under development

     Few  new  bugs  have  been  found  in  the 2.0.45 release so far; a
     problem with the --enable-layout flag broke a few builds, for which
     Jeff  Trawick  quickly [1]posted a patch. The 2.0.45 release is the
     first  to  be  based on the stable branch of the 2.0 tree under the
     new  dual-branch  strategy  adopted  for 2.0 development in January
     this  year.  The  strategy  appears  to  be  working well, with the
     development  of  new  features  on the "unstable" branch continuing
     alongside efforts to further stabilise the server.

                               Security Reports

     Last  week  we  reported  on  the  release  of  Apache 2.0.45 which
     contained   a   fix  for  an  undisclosed  security  vulnerability,
     [2]CAN-2003-0132.

     iDefense  [3]released an advisory which explains the details of the
     vulnerability.  A  remote  attacker  can send requests with a large
     number  of  linefeed characters causing a large amount of memory to
     be allocated by Apache, resulting in denial of service.

     The  fix for this issue was to limit the number of blank lines that
     Apache  would  accept  to  100,  and this fix was incorporated into
     Apache 2.0.45

     All  users  of  Apache  2  should upgrade to Apache 2.0.45 or use a
     [4]backported fix for this issue. An example exploit for this issue
     has [5]already been released.

                               Featured articles

     In  this  section we highlight some of the articles on the web that
     are of interest to Apache users.

     [6]"Enabling  WebDAV  on  Apache"  shows  you  how to integrate the
     mod_dav module into Apache version 1.3.x and 2.x on Unix, Mac OS X,
     and   MS   Windows.  It  covers  the  DAVLockDB  and  DAVMinTimeout
     directives,  and  explains  how  to  restrict  access to individual
     DAV-enabled directories by using basic authentication.

     WebReference.com  continues with its [7]final excerpt from "Chapter
     5:  Authentication" of "Apache: The Definitive Guide, 3rd Edition",
     courtesy  of  O'Reilly.  It  covers digest authentication, enabling
     anonymous  access,  the  pros and cons of using the .htaccess file,
     the  AllowOverride  directive,  and also the directives provided by
     the mod_auth_digest and mod_auth_anon modules.

     In  [8]"Using  OpenBSD's  chrooted httpd", Marc Balmer examines the
     impact a chrooted Apache has on CGI scripts and shared libraries. A
     chrooted  web server that uses PHP4 to access a PostgreSQL database
     is  provided  as  an  example.  He  concludes  that  this is a good
     security  enhancement  despite  the  inconvenience it causes system
     administrators. The article is available to be downloaded in [9]PDF
     format.

     IBM developerWorks presents the benefits of using the Java platform
     for server applications and then looks at how to safely deploy Java
     services on Linux with [10]a standalone implementation of Tomcat as
     an  example.  It  provides  two  solutions  for redirecting port 80
     requests  to  Tomcat's  default  port  8080  -  by using either the
     redirection feature in xinetd or by adding a rule to the PREROUTING
     chain  in  the nat (Network Address Translation) table in iptables.
     It ends by giving you an overview of how to confine Tomcat inside a
     chroot prison.
       ______________________________________________________________

     This issue brought to you by: Mark J Cox, Joe Orton, Min Min Tsan
     Comments or criticisms? Please email us at
     [11][email protected].

     [12]Apache Week is Copyright 2003 [13]Red Hat, Inc.

References

   1. http://www.apache.org/dist/httpd/patches/apply_to_2.0.45/
   2. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0132
   3. http://www.idefense.com/advisory/04.08.03.txt
   4. http://www.apache.org/dist/httpd/patches/apply_to_2.0.44/denial_of_service_fix.patch
   5. http://marc.theaimsgroup.com/?l=bugtraq&m=104994309010974&q=raw
   6. http://www.serverwatch.com/tutorials/article.php/10825_2176771_1
   7. http://www.webreference.com/internet/apache/chap5/3/index.html
   8. http://www.etc.msys.ch/docs/
   9. http://www.etc.msys.ch/docs/chrooted_httpd.pdf
  10. http://www-106.ibm.com/developerworks/java/library/l-secjav.html
  11. mailto:[email protected]
  12. http://www.apacheweek.com/
  13. http://www.redhat.com/

----------------------------------------------------------------------
To unsubscribe: https://listman.redhat.com/mailman/listinfo/apacheweek
or send the message   "unsubscribe"  to  [email protected]
----------------------------------------------------------------------