The Apache Software Foundation and the Apache Server Project on Thursday released Version 1.3.27 of its popular Web server software, an upgrade that includes fixes to three security vulnerabilities.
The new Apache HTTP server (download new version here) was described as principally a security and bug-fix release. It plugs a hole that exists in all versions of Apache prior to 1.3.27 on platforms using System V shared memory based scoreboards.
That vulnerability allows an attacker to execute code under the Apache UID to exploit the Apache shared memory scoreboard format and send a signal to any process as root or cause a local denial-of-service attack.
Another bug that made Apache susceptible to a cross site scripting vulnerability in the default 404 page of any Web server hosted on a domain that allows wildcard DNS lookups was also secure.
The Apache Foundation said some possible overflows in ab.c, which could be exploited by a malicious server, were also fixed.
It has been fitted with a new ErrorHeader directive and configuration file globbing that can now use simple pattern matching. Apache has also made the protocol version (eg: HTTP/1.1) in the request line parsing case-insensitive, a key upgrade over previous versions.
Other highlights include:
On specific platforms, new features in the upgrade include support for Caldera OpenUNIX 8 and the ability to use SysV semaphores by default on OpenBSD. It also implements file locking in mod_rewrite for the NetWare CLib platform.
The Foundation said several minor bugs found in Apache 1.3.26 (or earlier), including mod_proxy fixes, have been included in Apache 1.3.27.
Separately, the Jakarta Ant-Dev has released Version 1.5.1 of Apache Ant, a Java-based build tool that allows full portability of pure Java code. (Download new version here. The Jakarta Ant-Dev upgrade also fixes several bugs in older versions.