[cobalt-security] RaQ3 and Apache DoS

[Chad <chad_ny_01@xxxxxxxxx>]

Group,

Just wanted to confirm (and verifiy) to the list that
it's in the wild... 

We have a few RaQ3's running the standard fare Apache
1.3.6 (shame, shame) in our racks.. One has been hit
by two DoS attacks in the last 72 hours... First HTTP
stops responding, then followed a few mins later by
other services starting to fail as well... Within
about 5-10 mins everything goes tits-up... 

The solution, reboot the box.. 

No entries in the logs except the one that Michael
noted which shows up in the error log as a "child pid
exit signal Segmentation fault"

Now CERT is reporting that;

>For Apache versions 1.2.2 through 1.3.24 inclusive,
>this vulnerability may allow the execution of 
>arbitrary code by remote attackers. Exploits are 
>publicly available that claim to allow the 
>execution of arbitrary code.

I-R-KNOT-STUPID (said the little script-kiddies)

COBALT/SUN - We need some confirmation that someone is
working on a fix and quick... (PLEASE)... This could
get REALLY NASTY REALLY QUICK..!!!



__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com