Re: [OT] Re: Apache Web Server vulnerability

2002-06-21 Thread Per Einar Ellefsen
At 20:06 21.06.2002, Philip Mak wrote: >On Fri, Jun 21, 2002 at 05:31:00AM -0700, Ask Bjoern Hansen wrote: > > 64bit binaries are exploitable. There are also exploits for several > > 32bit systems. > >Does anyone know if Red Hat Linux 7.2 on i686 is vulnerable to the >remote shell (not the DoS) e

Re: [OT] Re: Apache Web Server vulnerability

2002-06-21 Thread Ilya Martynov
> On Fri, 21 Jun 2002 14:06:45 -0400, Philip Mak <[EMAIL PROTECTED]> said: PM> On Fri, Jun 21, 2002 at 05:31:00AM -0700, Ask Bjoern Hansen wrote: >> 64bit binaries are exploitable. There are also exploits for several >> 32bit systems. PM> Does anyone know if Red Hat Linux 7.2 on i686 is vul

[OT] Re: Apache Web Server vulnerability

2002-06-21 Thread Philip Mak
On Fri, Jun 21, 2002 at 05:31:00AM -0700, Ask Bjoern Hansen wrote: > 64bit binaries are exploitable. There are also exploits for several > 32bit systems. Does anyone know if Red Hat Linux 7.2 on i686 is vulnerable to the remote shell (not the DoS) exploit?

Apache Web Server vulnerability the full monte

2002-06-21 Thread dreamwvr
June 21, 2002 High Risk Apache Exploit Circulating By Ryan Naraine The Apache Foundation has issued a warning that exploits to its chunk handling vulnerability are circulating on the Internet, putting users of its open-source server at high risk. The vulnerability, which Apache now says aff

Re: Apache Web Server vulnerability

2002-06-21 Thread dreamwvr
On Fri, Jun 21, 2002 at 05:31:00AM -0700, Ask Bjoern Hansen wrote: > On Wed, 19 Jun 2002, dreamwvr wrote: > > > "my comments FWIW" > > This means thus far does not impact as_seriously little endian NIX > > based architectures. The reason being? That Apache spawns a pool of > > child processes to

Re: Apache Web Server vulnerability

2002-06-21 Thread Igor Sysoev
On Fri, 21 Jun 2002, Ask Bjoern Hansen wrote: > On Thu, 20 Jun 2002, Lupe Christoph wrote: > > [...] > > Sorry that is not the answer to my question - the question is if my > > code gets a chance to do *anything*, or will the httpd code just > > crash at a later time? It does not crash like a no

Re: Apache Web Server vulnerability

2002-06-21 Thread Ask Bjoern Hansen
On Wed, 19 Jun 2002, dreamwvr wrote: > "my comments FWIW" > This means thus far does not impact as_seriously little endian NIX > based architectures. The reason being? That Apache spawns a pool of > child processes to serve requests. Therefore a DoS kills the child serving [...] This doesn't mak

Re: Apache Web Server vulnerability

2002-06-21 Thread Ask Bjoern Hansen
On Thu, 20 Jun 2002, Lupe Christoph wrote: [...] > Sorry that is not the answer to my question - the question is if my > code gets a chance to do *anything*, or will the httpd code just > crash at a later time? It does not crash like a non-mod_perl httpd. I believe it only crashes when using the

Re: Apache Web Server vulnerability

2002-06-21 Thread Igor Sysoev
On Fri, 21 Jun 2002, Richard [utf-8] Čepas wrote: > On Wed Jun 19 17:54:02 2002 +0400 Igor Sysoev wrote: > > >On 19 Jun 2002, Ilya Martynov wrote: > > > >> If you still do not know about it: > >> > >> http://httpd.apache.org/info/security_bulletin_20020617.txt > >> > >> Now mod_perl questi

Re: Apache Web Server vulnerability

2002-06-21 Thread Igor Sysoev
On Thu, 20 Jun 2002, Lupe Christoph wrote: > On Thursday, 2002-06-20 at 18:22:10 +0400, Igor Sysoev wrote: > > On Thu, 20 Jun 2002, Lupe Christoph wrote: > > > > > and the mod_perl module seems to prevent the crash: > > > > > > > telnet proxy.customer.de 80 > > > > Trying 213.155.64.138... > >

Re: Apache Web Server vulnerability

2002-06-21 Thread Richard Čepas
On Wed Jun 19 17:54:02 2002 +0400 Igor Sysoev wrote: >On 19 Jun 2002, Ilya Martynov wrote: > >> If you still do not know about it: >> >> http://httpd.apache.org/info/security_bulletin_20020617.txt >> >> Now mod_perl question. mod_perl servers often are used as backend >> servers. I.e. they

Re: Apache Web Server vulnerability

2002-06-20 Thread Lupe Christoph
On Thursday, 2002-06-20 at 18:22:10 +0400, Igor Sysoev wrote: > On Thu, 20 Jun 2002, Lupe Christoph wrote: > > > and the mod_perl module seems to prevent the crash: > > > > > telnet proxy.customer.de 80 > > > Trying 213.155.64.138... > > > Connected to proxy.customer.de. > > > Escape character i