Linux and Unix vendors are releasing fixes for a critical bug in the popular Web server Apache that could allow attackers to crash the system or execute malicious code. The bug affects Apache 1.3.x installations configured to act as proxy servers, which relay requests between a Web browser and the Internet. When a vulnerable server connects to a malicious site, a specially crafted packet can be used to exploit the vulnerability, according to security researcher Georgi Guninski, who has publicly released exploit code. . . .
Linux and Unix vendors are releasing fixes for a critical bug in the popular Web server Apache that could allow attackers to crash the system or execute malicious code.

The bug affects Apache 1.3.x installations configured to act as proxy servers, which relay requests between a Web browser and the Internet. When a vulnerable server connects to a malicious site, a specially crafted packet can be used to exploit the vulnerability, according to security researcher Georgi Guninski, who has publicly released exploit code.

The bug is most serious on BSD installations, where it may allow code execution, while on other platforms the most likely effect is a system crash, researchers said. A reference in the Common Vulnerabilities and Exposures database can be found here.

Guninski released information about the proxy-server bug earlier this month, and last month discovered a similar vulnerability in an Apache component offering Secure Sockets Layer encryption, but he said the bugs don't reflect on Apache's overall security relative to competitors such as Microsoft's Internet Information Services. "Still Apache is much better than Windows," he said in an advisory.

The link for this article located at computerworld.com is no longer available.