APACHE SECURITY WARNING

"Attached is a remote Apache 1.3.X exploit for the "chunking" vulnerability. This version of the exploit works only on OpenBSD. "Experts" have argued as to why this is not exploitable on x86/*nix. This version of the exploit has been modified to convince these "experts" that they are wrong. Further, it is very ./friendly and all scriptkids/penetration testers should be able to run it without any trouble."


Vse urgiram, da naj si preberejo http://httpd.apache.org/ [+] in to naredijo cim prej.

Ne. Jaz vem, da niso.

Masine za katere skrbim jaz so ze popatchane, pri strankah
pa gotovo vsaj 90% niso in se zlepa ne bodo, cetudi bo nekdo
odkril exploit za x86.

Pravzaprav exploit za x86 ze obstaja, ampak samo za
OpenBSD, slejkoprej pa botudi za FreeBSD, Linux in ostale.

Pa ne da bo to kaj pomagalo pri povprecnemu "sistemcu", ki
je vesel ze ce mu Apache sploh dela, spremljanje securiity zadev
pa mu je spanska vas.

Moje mnenje je, da bo na slovenskem delu Interneta cez pol
leta se vedno 50% Apachejev nepopatchanih, razen ce se
bo pojavil kaksen resen exploit, ki bo vse tiste masine spravil
offline in bo potrebna reinstalacija :-)

Ravno tako kot je pri nas se ogromno open relay Exchange-ov
5.5 in starejsih in nepopatchanih IIS-jev (Nimda, Code Red,...)

lp,
Borut.