论文部分内容阅读
在六月份 Oracle 公司易损性检测过程中,工程师 Mark Litchfield 发现了对 Apache 在 Windows 平台上的拒绝服务攻击,后经Apache 软件基地测试发现,Apache 在处理以分块(chunked)方式传输数据的 HTTP 请求时存在设计漏洞,远程攻击者可能利用此漏洞在某些 Apache 服务器上以 Web 服务器进程的权限执行任意指令或进行拒绝服务攻击。对于1.3到1.3.24(含1.3.24)版本的 Apache,现在已经证实在 Win32系统下,远程攻击者可能利用这一漏洞执行任意代码。在 UNIX 系统下,利用这一漏洞执行代码可能是非常
During the Oracle vulnerability testing process in June, engineer Mark Litchfield discovered a denial-of-service attack on Apache on the Windows platform. After testing with the Apache software base, Apache found that it was handling HTTP in chunked mode A design flaw exists on request, and remote attackers could exploit this vulnerability to execute arbitrary commands or denial of service attacks on certain Apache servers with the authority of the Web server process. For versions 1.3 to 1.3.24 (including 1.3.24) of Apache, it has now been confirmed that on Win32 systems, a remote attacker could exploit this vulnerability to execute arbitrary code. Under UNIX, the code to exploit this vulnerability can be very painful