A serious vulnerability has been discovered inApache, the popular web server software that is used most frequently on UNIX and Linux boxen (although there are also Win32 ports, etc.). The recentlydisclosedvulnerability allows a specially crafted, chunk-encoded HTTP request to execute arbitrary code on the server, and as Microsoft would say, "a malicious user" could exploit this to damage systems, take over a box, or worse. Aworm is already the wildto take advantage of the exploit, so upgrading is a must. Fortunately, Apache 1.3.26 has been released with the fix. If you rundebian, you can apt-get the latest packages. If you runRedHat, RPMs for 1.3.26 are not available, but you can grab the a patched 1.3.22 fromhere. Otherwise head to yourclosest Apache mirrorand upgrade. Thanks to StoneTable, the Ars codemaster extraordinaire, for pointing this out and for patching our own boxen.
