发布日期：2003-07-08
更新日期：2004-05-05

受影响系统：

Apache Group Apache 2.0 < 2.0.47

不受影响系统：

Apache Group Apache 2.0.47

描述：

---

BUGTRAQ  ID: 8137
CVE(CAN) ID: CVE-2003-0253

Apache是一款使用广泛的开放源代码WEB服务程序。

Apache 2的2.0.47之前版本prefork MPM不能正确的处理某些来自accept的错误。如果在很少访问的端口上的accept()返回某些错误消息的话，就可能导致临时的拒绝服务。

<*来源：Jeff Trawick
        Saheed Akhtar （S.Akhtar@talis.com）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=105776593602600&w=2
                http://www.linux-mandrake.com/en/security/2003/2003-075.php
        https://www.redhat.com/support/errata/RHSA-2003-240.html
*>

建议：

---

厂商补丁：

Apache Group
------------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载2.0.47：

http://httpd.apache.org/download.cgi

HP
--
HP已经为此发布了一个安全公告（HPSBUX0309-278）以及相应补丁:
HPSBUX0309-278：SSRT3623 Security Vulnerabilities in Apache HTTP Server&lt;/Descripti
链接：

补丁下载：

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=HPUXWSSUITE

MandrakeSoft
------------
MandrakeSoft已经为此发布了一个安全公告（MDKSA-2003:075）以及相应补丁:
MDKSA-2003:075：Updated apache2 packages fix multiple vulnerabilities
链接：http://www.linux-mandrake.com/en/security/2003/2003-075.php

补丁下载：

Updated Packages:

Mandrake Linux 9.1:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/apache-conf-2.0.44-11.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/apache2-2.0.47-1.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/apache2-common-2.0.47-1.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/apache2-devel-2.0.47-1.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/apache2-manual-2.0.47-1.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/apache2-mod_dav-2.0.47-1.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/apache2-mod_ldap-2.0.47-1.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/apache2-mod_ssl-2.0.47-1.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/apache2-modules-2.0.47-1.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/apache2-source-2.0.47-1.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/libapr0-2.0.47-1.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/SRPMS/apache-conf-2.0.44-11.1mdk.src.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/SRPMS/apache2-2.0.47-1.1mdk.src.rpm

Mandrake Linux 9.1/PPC:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/apache-conf-2.0.44-11.1mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/apache2-2.0.47-1.1mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/apache2-common-2.0.47-1.1mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/apache2-devel-2.0.47-1.1mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/apache2-manual-2.0.47-1.1mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/apache2-mod_dav-2.0.47-1.1mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/apache2-mod_ldap-2.0.47-1.1mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/apache2-mod_ssl-2.0.47-1.1mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/apache2-modules-2.0.47-1.1mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/apache2-source-2.0.47-1.1mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/libapr0-2.0.47-1.1mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/SRPMS/apache-conf-2.0.44-11.1mdk.src.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/SRPMS/apache2-2.0.47-1.1mdk.src.rpm

上述升级软件还可以在下列地址中的任意一个镜像ftp服务器上下载：
http://www.mandrakesecure.net/en/ftp.php

RedHat
------
RedHat已经为此发布了一个安全公告（RHSA-2003:240-01）以及相应补丁:
RHSA-2003:240-01：Updated httpd packages fix Apache security vulnerabilities
链接：https://www.redhat.com/support/errata/RHSA-2003-240.html

补丁下载：

Red Hat Linux 8.0:

SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/httpd-2.0.40-11.7.src.rpm

i386:
ftp://updates.redhat.com/8.0/en/os/i386/httpd-2.0.40-11.7.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/httpd-devel-2.0.40-11.7.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/httpd-manual-2.0.40-11.7.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/mod_ssl-2.0.40-11.7.i386.rpm

Red Hat Linux 9:

SRPMS:
ftp://updates.redhat.com/9/en/os/SRPMS/httpd-2.0.40-21.5.src.rpm

i386:
ftp://updates.redhat.com/9/en/os/i386/httpd-2.0.40-21.5.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/httpd-devel-2.0.40-21.5.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/httpd-manual-2.0.40-21.5.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/mod_ssl-2.0.40-21.5.i386.rpm
可使用下列命令安装补丁：

rpm -Fvh [文件名]

浏览次数：3313
严重程度：0（网友投票）