UNfortunately, the original apache announcement was inaccurate. They now have an update, which says:
- 32bit systems are indeed just a vulnerable as 64bit systems. - an exploit is available in the wild! ============================================== This follow-up to our earlier advisory is to warn of known-exploitable conditions related to this vulnerability on both 64-bit platforms and 32-bit platforms alike. Though we previously reported that 32-bit platforms were not remotely exploitable, it has since been proven by Gobbles that certain conditions allowing exploitation do exist. Successful exploitation of this vulnerability can lead to the execution of arbitrary code on the server with the permissions of the web server child process. This can facilitate the further exploitation of vulnerabilities unrelated to Apache on the local system, potentially allowing the intruder root access. ============================================== So i guess the urgency to upgrade should be a priority after all. On 22 Jun 2002, Maxi M. Bernales, Jr. wrote: > Agree. > > The apache bug cannot compromise your system. DOS ang mangyayari sa > iyo. > > To avoid this, download the latest apache version because they released > a fix for this problem. > > Maxi > > > On Fri, 2002-06-21 at 17:53, Ian C. Sison wrote: > > > > Teka teka teka. Teka lang.. > > > > Again, to avoid mass hysteria, please note that apache running on intel 32 > > bit linux platforms (which will be around 99% of those in PLUG) is only > > vulnerable in the sense that the httpd binary will core dump, the result > > being that the system will need to re-spawn a new instance of httpd. The > > resultant tear down and bring up will result in a limited DoS on systems > > wherein apache's footprint is large (read: statically linked mod_perl or > > php). > > > > So for 99% of you, the worst possible scenario is a webserver trashing > > and going up and down, assuming someone actually runs a fairly good DoS > > program based on the exploit. No remote root here, so the urgency is not > > as high as it may seem to be. > > > > Ian > > > > > > On Fri, 21 Jun 2002, Miguel G. de Leon wrote: > > > > > FYI > > > > > > APACHE EXPLOIT CIRCULATING, USERS URGED TO PATCH > > > (Source: IDG.net) If users have put off patching their Apache Web > > > servers against the vulnerability discovered Monday, they should > > > wait no longer, as an exploit to attack the security hole is now > > > circulating on the Internet. > > > http://www.idg.net/go.cgi?id=702555 > > > > > > miguel > > > _______________________________________________ > > > ph-linux-newbie mailing list > > > http://lists.q-linux.com/mailman/listinfo/ph-linux-newbie > > > plug website http://plug.linux.org.ph > > > to unsubscribe, send 'unsubscribe' to [EMAIL PROTECTED] > > > > > > > _______________________________________________ > > ph-linux-newbie mailing list > > http://lists.q-linux.com/mailman/listinfo/ph-linux-newbie > > plug website http://plug.linux.org.ph > > to unsubscribe, send 'unsubscribe' to [EMAIL PROTECTED] > > > _______________________________________________ > ph-linux-newbie mailing list > http://lists.q-linux.com/mailman/listinfo/ph-linux-newbie > plug website http://plug.linux.org.ph > to unsubscribe, send 'unsubscribe' to [EMAIL PROTECTED] > _ Philippine Linux Users Group. Web site and archives at http://plug.linux.org.ph To leave: send "unsubscribe" in the body to [EMAIL PROTECTED] To subscribe to the Linux Newbies' List: send "subscribe" in the body to [EMAIL PROTECTED]
