Apache Week issue 347

                                APACHE WEEK

The essential weekly guide for users of the world's most popular Web server.
                          Issue 347: 2nd July 2004

                                 In this issue

     * Apache httpd 2.0.50 Released
     * In the news
     * Featured articles

                         Apache httpd 2.0.50 Released

     Apache  httpd  2.0.50 was released on 1^st July 2004 and is now the
     latest  version  of  the httpd 2.0 server. The previous version was
     2.0.49,  released  on  the 19^th March 2004. [1]See what was new in
     Apache httpd 2.0.49.

     [2]Apache httpd 2.0.50 is available for download.

     This  is  a  security,  bug  fix  and minor upgrade release. Due to
     security  issues,  any  sites using versions of 2.0 prior to Apache
     httpd  2.0.50  should  upgrade to Apache httpd 2.0.50. [3]Read more
     about the other security issues that affect 2.0.

Security issues

     * A  memory  leak  in parsing of HTTP headers which can be triggered
       remotely  may  allow  a  denial of service attack due to excessive
       memory  consumption.  The  Common  Vulnerabilities  and  Exposures
       project has assigned the name [4]CAN-2004-0493 to this issue.
     * A  buffer  overflow  in  the  mod_ssl  FakeBasicAuth code could be
       exploited by an attacker using a (trusted) client certificate with
       a  subject  DN  field  which  exceeds  6K  in  length.  The Common
       Vulnerabilities  and  Exposures  project  has  assigned  the  name
       [5]CAN-2004-0488 to this issue.

New features

     The following new features have been added in httpd 2.0.50:
     * inclusion of new forensic logging module, mod_log_forensic
     * mod_headers: the RequestHeader directive can be used conditionally
     * mod_alias:  warnings  will  be  issued at startup if aliases which
       overlap are configured

Bugs fixed

     The following bugs have been fixed in httpd 2.0.50:
     * core:  a  VirtualHost  specified  by hostname will be used for all
       addresses  which  that  hostname resolves to; log files can exceed
       the  2Gb  size  limit  on  some  32-bit  platforms  ([6]BZ#13511);
       correctly   NUL-terminate   long   request  lines  before  logging
       ([7]BZ#28376); fix crash with no Listen directives
     * mod_ldap/mod_auth_ldap:   many   stability   and  LDAP  connection
       handling  issues  fixed  along  with several other bug fixes (BZs:
       [8]#24801,    [9]#22602,   [10]#26390,   [11]#28250,   [12]#19304,
       [13]#24437, [14]#27748, [15]#17274)
     * mod_cgi:   fix   handling   of  CGI  script  stderr  output  (BZs:
       [16]#22030, [17]#18348)
     * mod_ssl:  fix  a  segfault  in  SSL shutdown handling, and several
       session caching fixes (BZs: [18]#27945, [19]#26562, [20]#27751)
     * mod_rewrite:    fix    handling    of   forward   proxy   requests
       ([21]BZ#295292)
     * mod_dav: fix a MKCOL response code and a crash in lock handling on
       some platforms ([22]BZ#29034)
     * mod_isapi:  header  and  variable  handling bugs (BZs: [23]#20656,
       [24]#20619, [25]#20617)
     * misc:  fix  memory  consumption  in mod_deflate, handling of empty
       headers in mod_headers, a segfault in mod_expires
     * support  tools:  htpasswd  uses  APR  temporary file handling, and
       handles files with empty lines; htdbm handles comments correctly
     * Unix-specific: handle new connections even when the number of file
       descriptors  in  use exceeds the platform's FD_SETSIZE definition;
       check   that  the  suexec  binary  is  really  setuid  root  again
       ([26]BZ#28287)
     * Win32-specific:  prevent  a  server hang when the number of Listen
       directives exceeds the configured ThreadsPerChild

                                  In the news

O'Reilly Open Source Convention 2004

     Less  than a month to go before the annual [27]O'Reilly Open Source
     Convention  opens  its  doors  in  Portland,  Oregon. This year the
     conference  runs  from  July  26-30 with many tracks of interest to
     Apache users.

ApacheCon USA 2004 Call For Papers

     Got  a  great idea for a presentation that would interest ApacheCon
     attendees? The conference planners recently released a [28]Call for
     Papers  for  the  upcoming conference in Las Vegas in November this
     year. Proposals are due in just a few weeks.

     If the prospect of early Christmas shopping in Vegas doesn't appeal
     how  about submitting a proposal to [29]"OSCOM.4 with ApacheTracks"
     in Zurich in October?

                               Featured articles

     In  this  section we highlight some of the articles on the web that
     are of interest to Apache users.

     Rich  Bowen  publishes  more  often than Apache Week, and this time
     he's  helping  users  choose  between Apache 1.3 and 2.0 in another
     [30]"A Day in the Life of #Apache".

     Fortunately   the   first   step   in   the  SecurityFocus  article
     [31]"Securing  Apache  2:  Step-by-Step"  isn't  to  turn  off your
     server.  Instead,  this  short  guide  gives a good set of tips and
     tricks including how to get Apache 2 running in a chroot jail.

     Dan   Wellman   gives   Dev  Shed  readers  a  brief  insight  into
     [32]"Configuring and Using Virtual Hosts in Apache".
       ______________________________________________________________

     This issue brought to you by: Mark J Cox, Joe Orton
     Comments or criticisms? Please email us at
     [33][email protected].

     [34]Apache Week is Copyright 2004 [35]Red Hat, Inc.

References

   1. http://www.apacheweek.com/issues/04-03-26#apache2049
   2. http://httpd.apache.org/download.cgi
   3. http://www.apacheweek.com/features/security-20
   4. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0493
   5. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488
   6. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=13511
   7. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=28376
   8. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=24801
   9. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=22602
  10. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26390
  11. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=28250
  12. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=19304
  13. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=24437
  14. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27748
  15. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=17274
  16. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=22030
  17. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=18348
  18. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27945
  19. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26562
  20. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27751
  21. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=295292
  22. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29034
  23. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=20656
  24. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=20619
  25. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=20617
  26. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=28287
  27. http://conferences.oreillynet.com/os2004/
  28. http://apachecon.com/2004/US/index.html#cfp
  29. http://www.oscom.org/events/oscom4/rfp
  30. http://www.onlamp.com/pub/a/apache/2004/06/17/apacheckbk.html
  31. http://www.securityfocus.com/infocus/1786
  32. http://www.devshed.com/c/a/Apache/Configuring-and-Using-Virtual-Hosts-in-Apache/
  33. mailto:[email protected]
  34. http://www.apacheweek.com/
  35. http://www.redhat.com/

----------------------------------------------------------------------
To unsubscribe visit https://www.redhat.com/mailman/listinfo/apacheweek
or send the message   "unsubscribe"  to   [email protected]
----------------------------------------------------------------------