We need to update to Apache 2.2.9 by September 14th, 2008.
Release notes:
http://www.apache.org/dist/httpd/Announcement2.2.html
This addresses two security advisories:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2364
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6420
Jim Basney from the OSG Security Team presented the following analysis,
and Doug Olson from the OSG Security Team agreed with it.
> From: Jim Basney <jbasney@ncsa.uiuc.edu>
> Date: August 22, 2008 1:52:52 PM PDT
> To: Alain Roy <roy@cs.wisc.edu>
> Cc: Doug Olson <dlolson@lbl.gov>,
> "Kevin L. Buterbaugh" <klb@accre.vanderbilt.edu>,
> maltunay@fnal.gov,
> osg-security-team@OPENSCIENCEGRID.ORG
> Subject: Re: VDT shipping Apache with security vulnerability (was Re:
> OSG Security question)
>
> Apache httpd vulnerabilities are listed at:
> http://httpd.apache.org/security/vulnerabilities_22.html
>
> All vulnerabilities since httpd 2.2.3 are listed as moderate or low
impact.
>
> The mod_proxy_http and mod_proxy_balancer modules are included in VDT
> but are they enabled? I don't see any <Proxy> configurations in
> $VDT_LOCATION/apache/conf in my VDT 1.10.1 install, so I provisionally
> conclude that they are not enabled.
>
> I provisionally rate this as low urgency (to be addressed on a
> best-effort basis). I suggest that httpd in VDT 1.10 should be updated
> by 14 September 2008 (3 months since the update was released by Apache).
> I further suggest that there's not a need to update the httpd in VDT
> 1.8 at this time.
>
> Alain, do you know if anyone has attempted to use their system httpd
> with VDT rather than the httpd provided by VDT? That may be a quick
> work-around for Kevin to satisfy his local security personnel until the
> httpd in VDT is updated.
>
> Please feel free to question or correct any of my conclusions above.
RT for crt.cs.wisc.edu
