Re: [cobalt-security] Apache worm that uses the chunk vulnerability - in the wild

[Michael Stauber <cobalt@xxxxxxxxxxxxxx>]

Hi Rick,

> Do you happen to know what version the Apache update 2.0.1 updates apache
> to? 

The Apache version remains unchanged after you install that patch. So on a 
RaQ3 you'll still have Apache-1.3.6, on an RaQ4, XTR and RaQ550 you'll still 
have Apache-1.3.20. 

All SUN/Cobalt did here was to implement a patch which fixes the chunked 
encoding issues. It was complicated enough - especially on the RaQ3, sure 
thing.

> Also - what is your recommendation for installing this Apache update?  I
> have seen you post in the past that you do your updates through ssh - would
> you recommend the same for this upgrade and if so, do you think you could
> be so kind as to list the instructions for the Raq4? 

No problem. We do it step by step:

Login by SSH or Telnet as user admin. Then do the following:

su -
(enter admin password again)
cd /home/packages
wget <URL of the patch>
/usr/local/sbin/cobalt_upgrade <filename>

That's it. 

With "wget" you can download files from the internet to your RaQ. With 
"/usr/local/sbin/cobalt_upgrade" you can install patches manually from the 
shell. However, if you download them to "/home/packages", then you could also 
apply them through the GUI in the "preloaded" pulldown menu. 

-- 

Mit freundlichen Grüßen / With best regards

Michael Stauber
mstauber@xxxxxxxxxxxxxx
Unix/Linux Support Engineer