Re: Apache Web Server vulnerability

2002-06-21 Thread Richard epas
On Wed Jun 19 17:54:02 2002 +0400 Igor Sysoev wrote: On 19 Jun 2002, Ilya Martynov wrote: If you still do not know about it: http://httpd.apache.org/info/security_bulletin_20020617.txt Now mod_perl question. mod_perl servers often are used as backend servers. I.e. they are not

Re: Apache Web Server vulnerability

2002-06-21 Thread Igor Sysoev
On Thu, 20 Jun 2002, Lupe Christoph wrote: On Thursday, 2002-06-20 at 18:22:10 +0400, Igor Sysoev wrote: On Thu, 20 Jun 2002, Lupe Christoph wrote: and the mod_perl module seems to prevent the crash: telnet proxy.customer.de 80 Trying 213.155.64.138... Connected to

Re: Apache Web Server vulnerability

2002-06-21 Thread Igor Sysoev
On Fri, 21 Jun 2002, Richard [utf-8] Čepas wrote: On Wed Jun 19 17:54:02 2002 +0400 Igor Sysoev wrote: On 19 Jun 2002, Ilya Martynov wrote: If you still do not know about it: http://httpd.apache.org/info/security_bulletin_20020617.txt Now mod_perl question. mod_perl servers

Re: Apache Web Server vulnerability

2002-06-21 Thread Ask Bjoern Hansen
On Wed, 19 Jun 2002, dreamwvr wrote: my comments FWIW This means thus far does not impact as_seriously little endian NIX based architectures. The reason being? That Apache spawns a pool of child processes to serve requests. Therefore a DoS kills the child serving [...] This doesn't make

Re: Apache Web Server vulnerability

2002-06-21 Thread Igor Sysoev
On Fri, 21 Jun 2002, Ask Bjoern Hansen wrote: On Thu, 20 Jun 2002, Lupe Christoph wrote: [...] Sorry that is not the answer to my question - the question is if my code gets a chance to do *anything*, or will the httpd code just crash at a later time? It does not crash like a

Re: Apache Web Server vulnerability

2002-06-21 Thread dreamwvr
On Fri, Jun 21, 2002 at 05:31:00AM -0700, Ask Bjoern Hansen wrote: On Wed, 19 Jun 2002, dreamwvr wrote: my comments FWIW This means thus far does not impact as_seriously little endian NIX based architectures. The reason being? That Apache spawns a pool of child processes to serve

Apache Web Server vulnerability the full monte

2002-06-21 Thread dreamwvr
June 21, 2002 High Risk Apache Exploit Circulating By Ryan Naraine The Apache Foundation has issued a warning that exploits to its chunk handling vulnerability are circulating on the Internet, putting users of its open-source server at high risk. The vulnerability, which Apache now says

[OT] Re: Apache Web Server vulnerability

2002-06-21 Thread Philip Mak
On Fri, Jun 21, 2002 at 05:31:00AM -0700, Ask Bjoern Hansen wrote: 64bit binaries are exploitable. There are also exploits for several 32bit systems. Does anyone know if Red Hat Linux 7.2 on i686 is vulnerable to the remote shell (not the DoS) exploit?

Re: [OT] Re: Apache Web Server vulnerability

2002-06-21 Thread Ilya Martynov
On Fri, 21 Jun 2002 14:06:45 -0400, Philip Mak [EMAIL PROTECTED] said: PM On Fri, Jun 21, 2002 at 05:31:00AM -0700, Ask Bjoern Hansen wrote: 64bit binaries are exploitable. There are also exploits for several 32bit systems. PM Does anyone know if Red Hat Linux 7.2 on i686 is vulnerable to

Re: [OT] Re: Apache Web Server vulnerability

2002-06-21 Thread Per Einar Ellefsen
At 20:06 21.06.2002, Philip Mak wrote: On Fri, Jun 21, 2002 at 05:31:00AM -0700, Ask Bjoern Hansen wrote: 64bit binaries are exploitable. There are also exploits for several 32bit systems. Does anyone know if Red Hat Linux 7.2 on i686 is vulnerable to the remote shell (not the DoS) exploit?

Re: Apache Web Server vulnerability

2002-06-20 Thread Lupe Christoph
On Thursday, 2002-06-20 at 18:22:10 +0400, Igor Sysoev wrote: On Thu, 20 Jun 2002, Lupe Christoph wrote: and the mod_perl module seems to prevent the crash: telnet proxy.customer.de 80 Trying 213.155.64.138... Connected to proxy.customer.de. Escape character is '^]'. POST