Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

New Apache Vulnerability

Discussion in 'EasyApache' started by sparek-3, Jul 29, 2006.

  1. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,601
    Likes Received:
    64
    Trophy Points:
    328
    cPanel Access Level:
    Root Administrator
    This should probably be posted in Bugzilla, but I wanted to make sure that this was an issue that affected CPanel first. Looks like there is a new bug in Apache, specifically in mod_rewrite:

    http://secunia.com/advisories/21197

    The recommended solution is to upgrade to Apache 1.3.37. It would appear that easyapache is at 1.3.36. I wasn't sure if this affected CPanel's Apache (I would think that it does) or exactly how serious this is.
     
    #1 sparek-3, Jul 29, 2006
  2. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,601
    Likes Received:
    64
    Trophy Points:
    328
    cPanel Access Level:
    Root Administrator
    #2 sparek-3, Jul 31, 2006
  3. speckados

    speckados Well-Known Member

    Joined:
    May 21, 2003
    Messages:
    311
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Pastrana :: Guadalajara :: España
    cPanel Access Level:
    DataCenter Provider
    Twitter:
    One more time, Cpanel Team, don't work for security on Cpanel/WHM.

    Expensive panel qith several problems of security issues.

    http://bugzilla.cpanel.net/show_bug.cgi?id=4433 has 48 hours.

    Security Advisore more 3 days.

    Explot calisfied CRITICAL.

    Please, Cpanel Team, more hard work on Security Issues.

    :p

    Advisorie of Apche Foundation:
    This issue has been rated as having important security impact by the Apache HTTP Server Security Team.onto http://www.apache.org/dist/httpd/Announcement1.3.html
     
    #3 speckados, Aug 2, 2006
    Last edited: Aug 2, 2006
  4. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,601
    Likes Received:
    64
    Trophy Points:
    328
    cPanel Access Level:
    Root Administrator
    Just a note, I ran easyapache this morning on a test server and it appears that 1.3.37 is being compiled now. Someone else may want to verify this and make sure 1.3.37 is installing. I'm not aware of any official word from CPanel, so I might proceed with caution regarding the upgrade, but I did want to let everyone know that it appears 1.3.37 is available now.
     
    #4 sparek-3, Aug 3, 2006
  5. MN-Robert

    MN-Robert Well-Known Member

    Joined:
    Feb 19, 2003
    Messages:
    203
    Likes Received:
    0
    Trophy Points:
    166
    Yes apache 1.3.37 is now in easyapache
     
    #5 MN-Robert, Aug 3, 2006
  6. nickp666

    nickp666 Well-Known Member

    Joined:
    Jan 28, 2005
    Messages:
    770
    Likes Received:
    2
    Trophy Points:
    168
    Location:
    /dev/null
    Under which tree is it available? EDGE?
     
    #6 nickp666, Aug 3, 2006
  7. perfect-games

    perfect-games Well-Known Member

    Joined:
    Nov 11, 2004
    Messages:
    100
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    alberta
    thats not the only bug i discovered bugs in openssl and can be exploted to gain root level access.

    oh well

    hope they fix it
     
    #7 perfect-games, Aug 3, 2006
  8. myusername

    myusername Well-Known Member
    PartnerNOC

    Joined:
    Mar 6, 2003
    Messages:
    693
    Likes Received:
    1
    Trophy Points:
    168
    Location:
    chown -R us.*yourbase*
    cPanel Access Level:
    DataCenter Provider
    Twitter:
    #8 myusername, Aug 3, 2006
  9. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,601
    Likes Received:
    64
    Trophy Points:
    328
    cPanel Access Level:
    Root Administrator
    As fas as I know the Apache version is indepdent of your CPanel build. So it doesn't matter what CPanel tree you are using, easyapache will install the same version of Apache for each build. I may be wrong in that regard. At any rate, I'm using Release and 1.3.37 is in it.
     
    #9 sparek-3, Aug 3, 2006
  10. gahelm

    gahelm Active Member

    Joined:
    Jun 21, 2003
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Florida
    I'm on the stable release tree and it will only compile 1.3.36. Any way to get 1.3.37 into the stable release tree?
     
    #10 gahelm, Aug 3, 2006
  11. gahelm

    gahelm Active Member

    Joined:
    Jun 21, 2003
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Florida
    Sorry, I guess I should have been more clear. I'm using the stable version, NOT release.
     
    #11 gahelm, Aug 3, 2006
  12. AndyReed

    AndyReed Well-Known Member
    PartnerNOC

    Joined:
    May 29, 2004
    Messages:
    2,222
    Likes Received:
    3
    Trophy Points:
    193
    Location:
    Minneapolis, MN
    Just re-compiled Apache on one of our client's servers and I got:

    Server: cPanel [10.8.2-RELEASE_119]
     
    #12 AndyReed, Aug 3, 2006
  13. MPCN_Russ1

    MPCN_Russ1 Member

    Joined:
    Jun 26, 2003
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    151
    Hey all,

    Does is cause any problems if you were to just manually configure any software like apache or php together manually rather then using cPanel? Will cPanel have any issues?

    Thanks,
    Russ
     
    #13 MPCN_Russ1, Aug 3, 2006
  14. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,601
    Likes Received:
    64
    Trophy Points:
    328
    cPanel Access Level:
    Root Administrator
    I don't know about Apache, but I always compile PHP separately. This is mainly because I want to do more customization to my PHP installs.

    One quick tidbit, if you run easyapache, you can unselect PHP so that it is not checked, then easyapache won't compile PHP. Your PHP will continue to work and easyapache will only compile Apache. This can greatly improve the amount of time spent upgrading Apache. One word of caution, if you are using phpSuExec, you must check that box in easyapache. You don't have to select PHP, but you do have to check the phpSuExec option. This is because the phpSuExec wrapper depends on some patches applied to Apache's source code, and selecting this option tells easyapache to apply those patches.

    Hope this helps.
     
    #14 sparek-3, Aug 3, 2006
  15. fleksi

    fleksi Well-Known Member

    Joined:
    Sep 17, 2003
    Messages:
    125
    Likes Received:
    0
    Trophy Points:
    166
    #15 fleksi, Aug 3, 2006
  16. pixel_fenix

    pixel_fenix Member

    Joined:
    Nov 23, 2003
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    151
    I can't seem to get apache to compile with mod_ssl Gives some hook error or something. Is anyone else experiencing this?
     
    #16 pixel_fenix, Aug 4, 2006
  17. arhs

    arhs Well-Known Member

    Joined:
    Jul 4, 2003
    Messages:
    116
    Likes Received:
    0
    Trophy Points:
    166
    #17 arhs, Aug 4, 2006
  18. a66fm

    a66fm Well-Known Member

    Joined:
    Jul 12, 2003
    Messages:
    78
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Greece
    yes in my case it was missing the
    Code:
    <IfDefine SSL>
    before the ssl virtual host
    and the
    Code:
    </IfDefine>
    after
     
    #18 a66fm, Aug 5, 2006
  19. IRCBrasil

    IRCBrasil Well-Known Member

    Joined:
    Jul 22, 2004
    Messages:
    93
    Likes Received:
    0
    Trophy Points:
    156
    Witch version? 0.9.8b is exploitable too?

     
    #19 IRCBrasil, Aug 6, 2006
  20. arhs

    arhs Well-Known Member

    Joined:
    Jul 4, 2003
    Messages:
    116
    Likes Received:
    0
    Trophy Points:
    166
    PHP 4.4.3 is now available in easyapache.
     
    #20 arhs, Aug 7, 2006
(You must log in or sign up to post here.)
Loading...
Similar Threads - Apache Vulnerability
  1. willkruss

    New Thread Apache not serving new certificates after AutoSSL

    willkruss, Apr 24, 2018 at 8:06 PM, in forum: Security
    Replies:
    0
    Views:
    17
    willkruss
    Apr 24, 2018 at 8:06 PM
  2. Nirjonadda

    EasyApache 4 update error

    Nirjonadda, Apr 24, 2018 at 4:43 PM, in forum: EasyApache
    Replies:
    3
    Views:
    21
    cPanelLauren
    Apr 24, 2018 at 5:02 PM
  3. cPStacy

    EasyApache 4 Update - April 24, 2018

    cPStacy, Apr 24, 2018 at 1:33 PM, in forum: EasyApache
    Replies:
    0
    Views:
    26
    cPStacy
    Apr 24, 2018 at 1:33 PM
  4. jmf1993

    Change all user's 'Required Score' for Apache SpamAssassin

    jmf1993, Apr 24, 2018 at 12:02 PM, in forum: E-mail Discussions
    Replies:
    5
    Views:
    56
    cPanelLauren
    Apr 24, 2018 at 4:55 PM
  5. vikins

    Post Apache Log Rotation

    vikins, Apr 23, 2018 at 3:38 PM, in forum: Workarounds and Optimization
    Replies:
    1
    Views:
    29
    cPanelLauren
    Apr 24, 2018 at 9:48 AM

Share This Page