>-----Original Message-----
>From: Wataru Nakagawa [mailto:[EMAIL PROTECTED]
>Sent: Donnerstag, 20. Marz 2003 08:02
>To: [EMAIL PROTECTED]
>Subject: Apache down under WindowNT
>
>
>How do you do.
>Since I am a Japanese, I am not so good at English.
>Please allow, even if there is a strange expression.
No problem - you expressed your problem very clearly :-) See comments
below...
>
>I am sorry to be main subject suddenly.
>
>The following phenomena have occurred by the Web server which I
>manage.
>The following log will be outputted to error.log of apache and apache
>will stop.
>(However, since it is rebooted automatically immediately, it has not
>been a big problem, now.)
>
>[Tue Feb 11 06:29:00 2003] [error] [client 61.206.119.242] client sent
>HTTP/1.1 request without hostname (see RFC2616 section 14.23): /
>[Tue Feb 11 06:29:08 2003] [error] mod_ssl: SSL handshake
>failed (server
>jbank:443, client 61.206.119.242) (OpenSSL library error follows)
>[Tue Feb 11 06:29:08 2003] [error] OpenSSL: error:1406908F:SSL
>routines:GET_CLIENT_FINISHED:connection id is different
>
>I knew and investigated the origin in question on the following pages.
>http://www.auscert.org.au/render.html?it=2409&cid=1
>
>Probably I think that I am the problem which has already become the
>center of attention by the following threads.
>[Red Hat Linux update for Linux Slapper worm]
>(http://marc.theaimsgroup.com/?l=openssl-users&m=103251679904499&w=2)
>
>Subject here was Red Hat Linux.
>However, my server is WindowsNT.
>(And Tomcat is 3.2.3 , Apache is 1.3.26 , mod_ssl is 2.8.10
>, OpenSSL is 0.9.6d )
Your error log matches exactly the error log in the security report so I
think you can be certain that it is the same problem. Note that it also
says in the security report:
"While Linux hosts running Apache are currently being targeted
by
the worm, any host running OpenSSL 0.9.6d or earlier (including
pre-release 0.9.7-beta2 or earlier) is vulnerable to the buffer
overflows in OpenSSL."
So the first attacks were against Linux hosts, but ANY machine using
OpenSSL 0.9.6d or earlier is vulnerable. The attack exploits a weakness
in the library, not in the OS.
>
>For the reason, it is troubled by judgment whether it is the really
>same problem.
>If it is coped (openSSL is upgraded to 0.9.6g or more ) with,
>we have to stop a server.
>It needs a serious decision.
>Therefore, by upgrade to 0.9.6g or more, it can be coped with truly
>or cannot have firm belief.
>
>And I want to know whether upgrade of Tomcat,Apache and mod_ssl are
>also required.
It depends a little on how you have installed these things. Tomcat
certainly doesn't need to be upgraded. If you are dynamically linking
openssl then you shouldn't need to recompile apache or mod_ssl. If you
are statically linking, you will need to recompile.
However, your apache is one version behind (current = 1.3.27) and
mod_ssl is three versions behind (current = 2.8.13). These upgrades
contain many security fixes so it would be wise to take this opportunity
to upgrade everything. The latest, safest mix is:
Apache 1.3.27
mod_ssl 2.8.13
openssl 0.9.7a + RSA blinding patch + KPR patch
Check the openssl website for details on these two patches.
Alternatively, wait until the patches are absorbed into a new release...
Rgds,
Owen Boyle
Disclaimer: Any disclaimer attached to this message may be ignored.
>
>Please let me know what it should carry out,Well-informed persons.
>
>Thanks you for your consideration.
>Thanks you.
>
>______________________________________________________________________
>OpenSSL Project http://www.openssl.org
>User Support Mailing List [EMAIL PROTECTED]
>Automated List Manager [EMAIL PROTECTED]
>
This message is for the named person's use only. It may contain
confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this message in error, please notify the sender urgently
and then immediately delete the message and any copies of it from your
system. Please also immediately destroy any hardcopies of the message.
You must not, directly or indirectly, use, disclose, distribute, print,
or copy any part of this message if you are not the intended recipient.
The sender’s company reserves the right to monitor all e-mail
communications through their networks. Any views expressed in this
message are those of the individual sender, except where the message
states otherwise and the sender is authorised to state them to be the
views of the sender’s company.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
