Free Software Magazine is a new magazine entirely dedicated to free software. It contains quality articles relating to both technical and non-technical issues. All published articles are released under a free license after their publication.

Support free software, support Free Software Magazine! Subscriptions are available now!

http://www.freesoftwaremagazine.com

The O'Reilly European Open Source Convention, happening 18-21 September 2007 in Brussels, Belgium, is where business people, coders, decision makers, entrepreneurs, artists, and policy makers using, creating, and managing free (libre) and open projects gather to learn about best practices, strategic issues, and coming changes. EuroOSCON will be filled to the brim with mindbending demos, provocative keynotes, hands-on practical tutorials, and lots of two-way interactivity.

Use discount code "euos06ling" and save 10% on convention fees. http://conference.oreilly.com/eurooscon

Come join the celebration of the 15th Anniversary of Linux at LINUXWORLD CONFERENCE and EXPO San Francisco August 14-17, 2006 - the ultimate Linux and open source gathering!

LinuxWorld has assembled the best, most complete educational program in its history with over 100+ educational sessions, visionary keynotes, the latest open source technologies and non-stop special events - don't miss this event!

For more information and to register, visit http://www.linuxworldexpo.com/sf

TITLE: Apache mod_rewrite Off-By-One Buffer Overflow Vulnerability

SECUNIA ADVISORY ID: SA21197

VERIFY ADVISORY: http://secunia.com/advisories/21197/

CRITICAL: Moderately critical

IMPACT: DoS, System access

WHERE: >From remote

SOFTWARE: Apache 1.3.x -- http://secunia.com/product/72/
Apache 2.0.x -- http://secunia.com/product/73/
Apache 2.2.x -- http://secunia.com/product/9633/

DESCRIPTION: A vulnerability has been reported in Apache HTTP Server, which potentially can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused by a off-by-one error in mod_rewrite and can be exploited to cause a one-byte buffer overflow.

Successful exploitation may crash the web server process or allow execution of arbitrary code. However, this depends on the manner which Apache HTTP Server was compiled and also requires the following:
* Certain types of Rewrite rules are used where the beginning of the rewritten URL is controlled.
* The RewriteRule flags do not include the Forbidden (F), Gone (G), or NoEscape (NE) flag.

The vulnerability affects Apache 1.3 since 1.3.28, 2.0 since 2.0.46, and 2.2 since 2.2.0.

SOLUTION: Update to version 1.3.37, 2.0.59, or 2.2.3.

PROVIDED AND/OR DISCOVERED BY: The vendor credits Mark Dowd, McAfee Avert Labs.

ORIGINAL ADVISORY:
http://www.apache.org/dist/httpd/Announcement1.3.html
http://www.apache.org/dist/httpd/Announcement2.0.html
http://www.apache.org/dist/httpd/Announcement2.2.html

nb1 writes:  

This is a couple of days old but worth reading

An identity-stealing keylogger that disguises itself as a Firefox extension and installs silently in the background was discovered Tuesday by security vendor McAfee. According to the Santa Clara, Calif.-based company, the "FormSpy" Trojan horse monitors mouse movements and key presses to steal online banking or credit card usernames and passwords, other login information, and URLs typed into Firefox, the popular open-source browser. Another component of the Trojan sniffs out passwords from ICQ and FTP sessions, and IMAP and POP3 traffic, said McAfee. All collected information is sent to an IP address hard-coded into the Trojan.

The scam starts with spam posing as a message from the billing support department of mega-retailer Wal-Mart, said Craig Schmugar, the virus research manager at McAfee's Avert Labs. "There's an order number in the message, which matches the number of the attachment," said Schmugar. "When someone opens the attachment, the Trojan downloads and installs two components, a keylogger as well as a sniffer." As of Tuesday afternoon, FormSpy had gained little traction

TechWeb

TITLE: Apache "Expect" Header Cross-Site Scripting Vulnerability

SECUNIA ADVISORY ID: SA21172

VERIFY ADVISORY: http://secunia.com/advisories/21172/

CRITICAL: Less critical

IMPACT: Cross Site Scripting

WHERE: >From remote

SOFTWARE:
Apache 1.3.x -- http://secunia.com/product/72/
Apache 2.0.x -- http://secunia.com/product/73/
Apache 2.2.x -- http://secunia.com/product/9633/

DESCRIPTION: Thiago Zaninotti has discovered a vulnerability in Apache HTTP Server, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed to the "Expect:" header is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

The vulnerability affects versions prior to 1.3.35, 2.0.58, and 2.2.2.

Secunia has constructed a test, which is available at: http://secunia.com/expect_header_cross-site_scripting_vulnerability_test/

NOTE: This issue was originally not considered a vulnerability by the researcher and vendor due to the fact that no known vectors existed to exploit it. However, additional research by Amit Klein has proven that this can be exploited via a specially crafted Flash file.

SOLUTION: Update to version 1.3.35, 2.0.58, 2.2.2, or later.

PROVIDED AND/OR DISCOVERED BY: Thiago Zaninotti

Additional information about exploitation:  Read More...