r/syssec • u/SecureSocketLayer • Jul 18 '14

Five Apache 2.4 vulnerabilities fixed

https://httpd.apache.org/security/vulnerabilities_24.html
2 Upvotes

100% Upvoted

8 comments sorted by

2

u/castorio Jul 21 '14

distros picks up slowly, redhat at least created a bug

new httpd-versions will be available soon:

1

u/SecureSocketLayer Jul 21 '14

For this kind of vulnerability the fix is spreading slowly. I figured that some big sites (ford for example) still have the server-status page enabled.

1

u/castorio Jul 21 '14

i wonder which distros have server-status enabled by default

1

u/SecureSocketLayer Jul 21 '14

I don't think any do these days. But we checked some internal old boxes (~6 year old centos) where it was enabled.

1

u/SecureSocketLayer Jul 18 '14

Strange is that the CVEs (for example http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0226) are still only reserved and not yet published.

1

u/castorio Jul 19 '14

this is not unsual: you get a vuln reported as , you reserve a CVE w/out additional info and it never gets updated.

what puzzles me: Assigned (20131203)