Skip to Content.
Sympa Menu

sm-security - Re: [SM-Security] Re: SECURITY UPDATE for http/apache2

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: sm-security AT lists.ibiblio.org
  • Subject: Re: [SM-Security] Re: SECURITY UPDATE for http/apache2
  • Date: Thu, 1 Jul 2004 08:35:03 -0700

Quoting Eric Schabell <eschabell AT sourcemage.org>:
> This only applies to 64 bit machines right?
>
> erics

>From what it sounded like to me (English is a fun language), the "The
ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote
attackers to cause a denial of service (memory exhaustion)" is for all systems
while the "integer signedness error leading to a heap-based buffer overflow on
64 bit systems, via long header lines with large numbers of space or tab
characters" is only for 64-bit systems.

And while I could be mistaken I felt I'd rather not take the chance. My server
and workstation updated to 2.0.50 without problems so I didn't see any reason
not to. And we have 1 (I think, maybe more ;)) user of a 64-bit system with
SMGL.

-sandalle

--
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61 | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.




Archive powered by MHonArc 2.6.24.

Top of Page