RHBA-2005:622 - Bug Fix Advisory

Topic

Updated httpd, apr and apr-util packages that fix a number of bugs are now
available.

Description

The Apache HTTP server is a powerful, full-featured, efficient, and
freely-available Web server. The Apache Portable Runtime library (APR) is
a portability layer used by the Apache HTTP server. The APR-util library
is a utility library used by the Apache HTPT server.

Several bugs were discovered in the handling of piped logging processes:

• A file descriptor leak could prevent the httpd parent process from

restarting piped logger processes that exit prematurely.

• An error handling issue could cause the httpd parent process to segfault

when restarting piped logger processes that exit prematurely.

• During a graceful restart, httpd child processes could hang when trying

to write to a piped logger process that has exited.

A bug in the handling of process creation routines in the APR library was
discovered. For example, when executing a CGI, APR could unnecessarily
refuse to execute the program if the containing directory did not allow
read permissions to the current process.

Previously, if a file was served without use of the sendfile() system call
and was truncated while being sent, the child process could go into an
infinite loop.

Several bugs in the cache handling of the LDAP authorization modules were
discovered, including several shared memory handling bugs in the apr-util
package. When used in LDAP environments with large numbers of users, httpd
child processes could crash when performing authorization checks.

All users of httpd should upgrade to these updated packages, which resolve
these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 157536 - Apache APR incorrectly requires R_OK for chdir(2)
• BZ - 157933 - httpd segfault on logrotate
• BZ - 157952 - httpd piped logging fd leak, graceful restart handling
• BZ - 159191 - Apache child infinite loop
• BZ - 159289 - mod_auth_ldap causes httpd child segfault when used with other mod_auth_*
• BZ - 160034 - httpd segfaults in mod_auth_ldap /util_ldap after several requests

CVEs

(none)

References

(none)