[users@httpd] CVE-2007-3008

["John T. Mills" <jo...@yahoo.com>]

I'm running 2.2.4 and I've been told I need to manually tweak mod_rewrite.c to fix CVE-2007-3008.  I can't find any mention of this bug in the bug list.

Here's my info:

Server version: Apache/2.2.4 (Unix)
Server built:   Jun  8 2007 08:19:28
Server's Module Magic Number: 20051115:4
Server loaded:  APR 1.2.8, APR-Util 1.2.8
Compiled using: APR 1.2.8, APR-Util 1.2.8
Architecture:   32-bit
Server MPM:     Prefork
  threaded:     no
    forked:     yes (variable process count)
Server compiled with....
 -D APACHE_MPM_DIR="server/mpm/prefork"
 -D APR_HAS_SENDFILE
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_SYSVSEM_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D DYNAMIC_MODULE_LIMIT=128
 -D HTTPD_ROOT="/apps/apache/httpd-2.2.4"
 -D SUEXEC_BIN="/apps/apache/httpd-2.2.4/bin/suexec"
 -D DEFAULT_PIDLOG="logs/httpd.pid"
 -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
 -D DEFAULT_LOCKFILE="logs/accept.lock"
 -D DEFAULT_ERRORLOG="logs/error_log"
 -D AP_TYPES_CONFIG_FILE="conf/mime.types"
 -D SERVER_CONFIG_FILE="conf/httpd.conf"

Does anyone know if this bug has been antiquated by a higher version of 2 or by a bugfix?  I checked the changelog, but, I didn't see anything.

Thanks,

John

Re: [users@httpd] CVE-2007-3008

[Joshua Slive <jo...@slive.ca>]

On Jan 9, 2008 3:05 PM, John T. Mills <jo...@yahoo.com> wrote:
>
>
> I'm running 2.2.4 and I've been told I need to manually tweak mod_rewrite.c
> to fix CVE-2007-3008.  I can't find any mention of this bug in the bug list.

I love the "I've been told" stuff. Who told you this, and do they know
what they are talking about?

You won't find CVE-2007-3008 listed anywhere because it is not related
to apache. It is for the Mbedthis AppWeb:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3008

It also doesn't look to be a serious problem in the first place. The
"TRACE" method is not really a security vulnerability. It can be
turned off in apache with the
TraceEnable off
directive.

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org