From owner-freebsd-hackers Thu Jun 20 14:21:29 2002 Delivered-To: freebsd-hackers@freebsd.org Received: from utility.clubscholarship.com (utility.clubscholarship.com [198.78.70.175]) by hub.freebsd.org (Postfix) with ESMTP id 8000637B4A0 for ; Thu, 20 Jun 2002 14:20:46 -0700 (PDT) Received: from localhost (root@localhost) by utility.clubscholarship.com (8.11.6/8.11.6) with ESMTP id g5KLHf489024 for ; Thu, 20 Jun 2002 14:17:46 -0700 (PDT) (envelope-from root@utility.clubscholarship.com) Date: Thu, 20 Jun 2002 14:17:41 -0700 (PDT) From: Patrick Thomas To: Subject: inuring FreeBSD to the apache bug without upgrading apache ? Message-ID: <20020620141424.U68572-100000@utility.clubscholarship.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Is it possible to patch/recompile FreeBSD 4.5 in such a way that your system is no longer vulnerable to the "chunking" attack, even if you are still running a vulnerable apache ? I ask because I see in one of the chunking exploits that: * Remote OpenBSD/Apache exploit for the "chunking" vulnerability. Kudos to * the OpenBSD developers (Theo, DugSong, jnathan, *@#!w00w00, ...) and * their crappy memcpy implementation that makes this 32-bit impossibility * very easy to accomplish. Which leads me to believe there are structures in the OS which "help" this vulnerability to exist. I am _very_ interested to find out if it is possible to patch this bug at the FreeBSD OS level and not the apache level. thanks, PT To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message