Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of SZastre@dryden.ca designates
 64.202.144.227 as permitted sender)
From: Sharon Zastre <SZastre@dryden.ca>
To: "users@httpd.apache.org" <users@httpd.apache.org>
Date: Mon, 29 Sep 2014 13:09:19 -0500
Thread-Topic: [users@httpd] Proposed simple shell-shock protection
Thread-Index: Ac/cD2EZq69JQhG9T7yFUKxlp43fiQAALjSQ
Message-ID: 
 <AF0250C053CBF34F90681479B776F1F80A40ABAA1D@exchange.citydryden.local>
References: <20140926154143.64f5f81f@baldur>
 <AF0250C053CBF34F90681479B776F1F80A40ABAA19@exchange.citydryden.local>
 <767AC8C9-DEAF-4F26-8F28-9E8DA35EF546@webthing.com>
In-Reply-To: <767AC8C9-DEAF-4F26-8F28-9E8DA35EF546@webthing.com>
Accept-Language: en-US, en-CA
Content-Language: en-US
acceptlanguage: en-US, en-CA
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: RE: [users@httpd] Proposed simple shell-shock protection

I will admit that I am far from an advanced user of Apache.  So for now I t=
hink I will hold off on trying to create the module.  Is it safe to assume =
that a fix/patch/upgrade will become available to address the shellshock vu=
lnerability?

Thanks,
Sharon

-----Original Message-----
From: Nick Kew [mailto:nick@webthing.com]=20
Sent: Monday, September 29, 2014 12:59 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Proposed simple shell-shock protection


On 29 Sep 2014, at 17:35, Sharon Zastre wrote:

> Thank you Nick for quickly looking into a solution/work around for the sh=
ellshock vulnerability.  But I'm confused as to how to implement it.  I am =
currently at Apache 2.4.9 with OpenSSL 1.0.1g.  Do I need to upgrade to 2.4=
.10 or 2.5(?) first?  Will it simply be in the install and I include mod_ta=
int in the config file?  Or is this a separate download that I need to run?

No, you don't need to upgrade anything.  Just build the module.
with your existing 2.2.x or 2.4.x.  Maybe even 2.0.x: I haven't tried!
If you don't know how, the tool you need is apxs, and the server docs expla=
in how to use it.

You should also be aware that if you're not accustomed to getting
your hands dirty, you might find it too 'bleeding edge'.   I just had a
bug report a few hours ago and have yet to find time to investigate.

--
Nick Kew
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org