Hi Christian, On Tuesday 18 May 2010, Christian Kapalczynski wrote: > just found the Bug about the "apr lib" which has been fixed by > Stefan in "apr 1.3.6". In Debian Lenny there is still the package > 1.2.12-5+lenny1 with the Security BUG available. > Since through this BUG you can compromise the system by Listening > to Port 80 or read every FD from the Apache Fork via a PHP or > Shell script i was wondering why there is no security package > update for apr 1.2.12-5+lenny1 to 1.3.6 at least or 1.4.2-3 > Testing is going to be backported for Lenny?
this is http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=366124 and affects only mod_php. As Debian's security support for mod_php is somewhat limited as far as malicious php scripts are concerned [1], this bug does not have high priority. If you are concerned about malicious php scripts, it is in any case a good idea to use suexec or fcgi to make them run as a different user. Maybe there will be an update for 1.2.12 in lenny in a stable point release, or maybe a newer version of apr will be made available via backports.org (there has been some demand for that). But I don't think this bug warrants a DSA. Cheers, Stefan [1] see /usr/share/doc/libapache2-mod-php5/README.Debian.security -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/[email protected]
