Web Server Security - Apache Risks

Apache Risks

Apache vulnerability are commonly found and if not patched, this can cause major security-risks. For example an old vulnerability was found in the Win32 port of Apache, it was when client submitting a very long URI could cause a directory listing to be returned rather than the default index page. A URL with a large number of trailing slashes: /cgi-bin ////////////// could produce directory listing of the original directory. There are more old big vulnerabilities like: (Remote DoS via IPv6), was when a client requests that proxy ftp connect to an ftp server with IPv6 address, and the proxy is unable to create an IPv6 socket, an infinite loop occurs causing a remote Denial of Service. (Remote DoS with multiple Listen directives), Apache server with multiple listening sockets a certain error returned by accept () on a rarely access port can cause a temporary denial of service, due to a bug in the prefork MPM. (Line feed memory leak DoS), Remote attackers can cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed. Rewrite rules that include references allow access to any file, Apache can serve unexpected files by appending illegal characters such as '<' to the request URL and few others. These are just some of old exploits that Apache whent trough and i belive there are more to be found. But ask your self, how many exploits are there that are not public? These are the more dengrous ones and can be used for months with out any one knowing.