Package name
apache2
Date
2003-10-24
Advisory ID
MDKSA-2003:096-1
Affected versions
9.2 i586 , 9.1 i586 , 9.1 i586

Problem description

A problem was discovered in Apache2 where CGI scripts that output more than 4k of output to STDERR will hang the script's execution which can cause a Denial of Service on the httpd process because it is waiting for more input from the CGI that is not forthcoming due to the locked write() call in mod_cgi. On systems that use scripts that output more than 4k to STDERR, this could cause httpd processes to hang and once the maximum connection limit is reached, Apache will no longer respond to requests. The updated packages provided use the latest mod_cgi.c from the Apache 2.1 CVS version. Users may have to restart apache by hand after the upgrade by issuing a "service httpd restart". Update: The previous update introduced an experimental mod_cgi.c that while fixing the deadlock did not do so in a correct manner and it likewise introduced new problems with other scripts. These packages roll back to the original mod_cgi.c until such a time as the apache team have a proper fix in place. Both Mandrake Linux 9.1 and 9.2 are affected with this problem. Likewise, a problem was discovered in the default mod_proxy configuration which created an open proxy. Users who have installed mod_perl also have mod_proxy installed due to dependencies and may unknowingly have allowed spammers to use their MTA via the wide-open mod_proxy settings. MandrakeSoft encourages all users to upgrade to these new packages immediately.

Updated packages

9.2 i586

 d8358bda85bfb2671af97ae8cfd754a2  9.2/RPMS/apache2-2.0.47-6.1.92mdk.i586.rpm
37d4d450259608ff4f156745b3d6a0b6  9.2/RPMS/apache2-common-2.0.47-6.1.92mdk.i586.rpm
004bb302d4a29aea85d279bb26f6cbcb  9.2/RPMS/apache2-devel-2.0.47-6.1.92mdk.i586.rpm
15b6e364990657d17f0b1f4df3b751a6  9.2/RPMS/apache2-manual-2.0.47-6.1.92mdk.i586.rpm
27938e3f6e2ec4314e2d2c205e8fe26d  9.2/RPMS/apache2-mod_cache-2.0.47-6.1.92mdk.i586.rpm
fc3042b41ec1708a11d752ee78f7fb2b  9.2/RPMS/apache2-mod_dav-2.0.47-6.1.92mdk.i586.rpm
e1f4236f8d51afc50c6772380cb50b34  9.2/RPMS/apache2-mod_deflate-2.0.47-6.1.92mdk.i586.rpm
e78c277bafebc5b43090e1cfadc3d8c8  9.2/RPMS/apache2-mod_disk_cache-2.0.47-6.1.92mdk.i586.rpm
0309bc5d51d36fd92f2edc110e097a14  9.2/RPMS/apache2-mod_file_cache-2.0.47-6.1.92mdk.i586.rpm
47da9f7f1dafcb1d02d4cac6bd28d78a  9.2/RPMS/apache2-mod_ldap-2.0.47-6.1.92mdk.i586.rpm
1a49a1936cee042389495ec8f4f6d4f1  9.2/RPMS/apache2-mod_mem_cache-2.0.47-6.1.92mdk.i586.rpm
e1828dddeb75c4e3df12292db93bb27d  9.2/RPMS/apache2-mod_proxy-2.0.47-6.1.92mdk.i586.rpm
1ad3c77daf86db3d1b2042b911d668ae  9.2/RPMS/apache2-mod_ssl-2.0.47-6.1.92mdk.i586.rpm
514956199b61185ee0c79015ccdeb58e  9.2/RPMS/apache2-modules-2.0.47-6.1.92mdk.i586.rpm
4b429cc7e33e9fb81510130c026320d8  9.2/RPMS/apache2-source-2.0.47-6.1.92mdk.i586.rpm
50c969427cb0448736f85e818362a0e3  9.2/RPMS/libapr0-2.0.47-6.1.92mdk.i586.rpm
15cee7a5fafdc0610ea4675b6ab2d46c  9.2/SRPMS/apache2-2.0.47-6.1.92mdk.src.rpm

9.1 i586

 f5d94eb1f0a64746434f828a6cf4acd7  ppc/9.1/RPMS/apache2-2.0.47-1.4.91mdk.ppc.rpm
2f5e0a20ebd13a1915e655dcc46ac33f  ppc/9.1/RPMS/apache2-common-2.0.47-1.4.91mdk.ppc.rpm
51d8563c8b2d92fd93aeea6397665919  ppc/9.1/RPMS/apache2-devel-2.0.47-1.4.91mdk.ppc.rpm
6a519e9a6861c719b8a25b63140ee2df  ppc/9.1/RPMS/apache2-manual-2.0.47-1.4.91mdk.ppc.rpm
d6986f2037233214aa557a5ff3c83194  ppc/9.1/RPMS/apache2-mod_dav-2.0.47-1.4.91mdk.ppc.rpm
1cf512ced3909a27eba9e0c361c792ee  ppc/9.1/RPMS/apache2-mod_ldap-2.0.47-1.4.91mdk.ppc.rpm
6288888bf0b3af6b4d4e946a0723479e  ppc/9.1/RPMS/apache2-mod_ssl-2.0.47-1.4.91mdk.ppc.rpm
42f1924400fa8988cb71ec58d0f5b455  ppc/9.1/RPMS/apache2-modules-2.0.47-1.4.91mdk.ppc.rpm
9026ab441d5a9a40438a0272dba9851f  ppc/9.1/RPMS/apache2-source-2.0.47-1.4.91mdk.ppc.rpm
70c48bdd53a0551c32469b8333b8c52d  ppc/9.1/RPMS/libapr0-2.0.47-1.4.91mdk.ppc.rpm
059fd94b8f53ad5dfb74f8123a0453c1  ppc/9.1/SRPMS/apache2-2.0.47-1.4.91mdk.src.rpm

9.1 i586

 0266407e6879970d75f699db87781e53  9.1/RPMS/apache2-2.0.47-1.4.91mdk.i586.rpm
498191ace6f5898042aa4aeaf19987bb  9.1/RPMS/apache2-common-2.0.47-1.4.91mdk.i586.rpm
2aab0ab5f06db331cab1b3cd61222703  9.1/RPMS/apache2-devel-2.0.47-1.4.91mdk.i586.rpm
565506f84deabf6ef5f9d7c220598565  9.1/RPMS/apache2-manual-2.0.47-1.4.91mdk.i586.rpm
4de0542aed8c6ec5f7390cf43e9de57b  9.1/RPMS/apache2-mod_dav-2.0.47-1.4.91mdk.i586.rpm
6d2fe30aa77c6b2522377a781ebe74db  9.1/RPMS/apache2-mod_ldap-2.0.47-1.4.91mdk.i586.rpm
1bf2c46c844ed09896154ceb51610429  9.1/RPMS/apache2-mod_ssl-2.0.47-1.4.91mdk.i586.rpm
5dd37e86e03ccf353845ef1f469186c2  9.1/RPMS/apache2-modules-2.0.47-1.4.91mdk.i586.rpm
a371874746bc9693dda494dd449ac9dc  9.1/RPMS/apache2-source-2.0.47-1.4.91mdk.i586.rpm
6df5048842e866d6d029efd15c8d9239  9.1/RPMS/libapr0-2.0.47-1.4.91mdk.i586.rpm
059fd94b8f53ad5dfb74f8123a0453c1  9.1/SRPMS/apache2-2.0.47-1.4.91mdk.src.rpm

References