sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] Re: SM-Security Digest, Vol 15, Issue 1

From: Eric Schabell <eschabell AT sourcemage.org>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] Re: SM-Security Digest, Vol 15, Issue 1
Date: Thu, 1 Jul 2004 21:33:06 +0200

> >From what it sounded like to me (English is a fun language), the "The
> ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote
> attackers to cause a denial of service (memory exhaustion)" is for all
> systems
> while the "integer signedness error leading to a heap-based buffer overflow
> on
> 64 bit systems, via long header lines with large numbers of space or tab
> characters" is only for 64-bit systems.
>
> And while I could be mistaken I felt I'd rather not take the chance. My
> server
> and workstation updated to 2.0.50 without problems so I didn't see any
> reason
> not to. And we have 1 (I think, maybe more ;)) user of a 64-bit system with
> SMGL.
>
I was not questioning the upgrade, just trying to figure out if I need
to apply it myself or not... thanks for the clarification.

erics

Attachment: pgpPL4e2wX6Q6.pgp
Description: PGP signature

[SM-Security] Re: SM-Security Digest, Vol 15, Issue 1, Eric Schabell, 07/01/2004
- Re: [SM-Security] Re: SM-Security Digest, Vol 15, Issue 1, Eric Sandall, 07/01/2004