 |
| latest from firepages |
| from PHP |
| from Apache |
| from MySQL |
 |
| Why PHP? |
| resistance is futile |
 |
| phpdev bundles |
| phpdev5 beta |
| phpdev FAQ |
 |
| phpdev forums |
| Sites running PHP |
| links to tutorials |
| resource links |
 |
 |
 |
|
Apache 2.0.39 Released The Apache HTTP Server Project is proud to announce the third public release of Apache 2.0. Apache 2.0 has been running on the Apache.org website since December of 2000 and has proven to be very reliable. This version of Apache is principally a security and bug fix release. Of particular note is that 2.0.39 addresses and fixes the issues noted in CAN-2002-0392 (mitre.org) [CERT VU#944335] regarding a vulnerability in the handling of chunked transfer encoding as described above. Apache 2.0 offers numerous enhancements, improvements and performance boosts over the 1.3 codebase. The most visible and noteworthy addition is the ability to run Apache in a hybrid thread/process mode on any platform that supports both threads and processes. This has shown to improve the scalability of the Apache HTTP Server significantly in our testing. Apache 2.0 also includes support for filtered I/O. This allows modules to modify the output of other modules before it is sent to the client. We have also included support for IPv6 on any platform that supports IPv6. This version of Apache is known to work on many versions of Unix, BeOS, OS/2, Windows, and Netware. Because of many of the advancements in Apache 2.0, the initial release of Apache is expected to perform equally well on all supported platforms. There are new snapshots of the Apache httpd source available every 6 hours from http://cvs.apache.org/snapshots/ - please download and test if you feel brave. We don't guarantee anything except that it will take up disk space, but if you have the time and skills, please give it a spin on your platforms. Note:: apache2.0.39 & PHP4.2.1(now 4.2.2) (when running as an apache module) have an uneasy relationship, this is as far as is known a PHP issue which should be fixed for 4.3.0, until then note that whilst apache2.0.39 does indeed work with PHP it can also do some quite unexpected things so don't say I did not tell you. (FP) Apache 1.3.26 Released The Apache Group is pleased to announce the release of the 1.3.26 version of the Apache HTTP Server. This version of Apache is principally a security and bug fix release. Of particular note is that 1.3.26 addresses and fixes the issues noted in CAN-2002-0392 (mitre.org) [CERT VU#944335] regarding a vulnerability in the handling of chunked transfer encoding as described above. SECURITY ADVISORY: June 20, 2002 UPDATE: (supersedes security bulletin 20020617) This follow-up to our earlier advisory is to warn of known-exploitable conditions related to this vulnerability on both 64-bit platforms and 32-bit platforms alike. Though we previously reported that 32-bit platforms were not remotely exploitable, it has since been proven by Gobbles that certain conditions allowing exploitation do exist. Successful exploitation of this vulnerability can lead to the execution of arbitrary code on the server with the permissions of the web server child process. This can facilitate the further exploitation of vulnerabilities unrelated to Apache on the local system, potentially allowing the intruder root access. Note that early patches for this issue released by ISS and others do not address its full scope. Due to the existence of exploits circulating in the wild for some platforms, the risk is considered high. The Apache Software Foundation has released versions 1.3.26 and 2.0.39 that address and fix this issue, and all users are urged to upgrade immediately. These versions are available for download; see below. If, for any reason, you are unable to upgrade at this time, as a minimum, this patch for httpd 1.2.0-1.3.22 should be applied to the source code. |