Apache 1.3.26 Released

Apache 1.3.26 Released

The Apache Software Foundation and The Apache Server Project are
pleased to announce the release of version 1.3.26 of the Apache HTTP
Server. This Announcement notes the significant changes in 1.3.26.

This version of Apache is principally a security and bug fix
release. A summary of the bug fixes is given at the end of this document.
Of particular note is that 1.3.26 addresses and fixes the issues noted
in CAN-2002-0392 (mitre.org) [CERT VU#944335] regarding a vulnerability
in the handling of chunked transfer encoding. We would like to thank
Mark Litchfield of ngssoftware.com for discovering and reporting the
vulnerability.

Apache 1.3.26 Released

We consider Apache 1.3.26 to be the best version of Apache 1.3 available
and we strongly recommend that users of older versions, especially of
the 1.1.x and 1.2.x family, upgrade as soon as possible. No further
releases will be made in the 1.2.x family. Users should also consider
upgrading to Apache 2.0 as soon as all of the modules they need become
available for 2.0.

Apache 1.3.26 is available for download from

http://www.apache.org/dist/httpd/

Please see the CHANGES_1.3 file in the same directory for a full list
of changes.

Binary distributions are available from

http://www.apache.org/dist/httpd/binaries/

The source and binary distributions are also available via any of the
mirrors listed at

http://www.apache.org/mirrors/

As of Apache 1.3.17, Win32 binary distributions are now based on the
Microsoft Installer (.MSI) technology. This change occurred in order to
resolve the many problems WinME and Win2K users experienced with the
older InstallShield-based installer.exe file. While development
continues to make this new installation method more robust, questions
should be directed at the news:comp.infosystems.www.servers.ms-windows
newsgroup.

As of Apache 1.3.12 binary distributions contain all standard Apache
modules as shared objects (if supported by the platform) and include
full source code. Installation is easily done by executing the
included install script. See the README.bindist and INSTALL.bindist
files for a complete explanation. Please note that the binary
distributions are only provided for your convenience and current
distributions for specific platforms are not always available.

For an overview of new features introduced after 1.2 please see

http://httpd.apache.org/docs/new_features_1_3.html

In general, Apache 1.3 offers several substantial improvements over
version 1.2, including better performance, reliability and a wider
range of supported platforms, including Windows NT and 2000 (which
fall under the "Win32" label), OS2, Netware, and TPE threaded
platforms.

Apache is the most popular web server in the known universe; over half
of the servers on the Internet are running Apache or one of its
variants.

IMPORTANT NOTE FOR WIN32 USERS: Over the years, many users have come
to trust Apache as a secure and stable server. It must be realized
that the current Win32 code has not yet reached the levels of the Unix
version, but is of acceptable quality. Win32 stability or security
problems do not reflect on the Unix version.

Apache 1.3.26 Major changes

Security vulnerabilities

* Fix the security vulnerability noted in CAN-2002-0392 (mitre.org)
regarding the handling of chunked transfer encoding.

New features

The main new features in 1.3.26 (compared to 1.3.24) are:

* Add some popular types to the mime types magic file.

New features that relate to specific platforms:

* Unix: Added a '-F' flag which causes the supervisor process to
no longer fork down and detach and instead stay attached to
the tty - thus making live for automatic restart and exit checking
code easier.

Bugs fixed

The following bugs were found in Apache 1.3.24 (or earlier) and have
been fixed in Apache 1.3.26:

* Allow child processes sufficient time for cleanups but making
ap_select in reclaim_child_processes more "resistant" to
signal interupts.

* Fix for a problem in mod_rewrite which would lead to 400 Bad Request
responses for rewriting rules which resulted in a local path.
Note: This will also reject invalid requests as issued by
Netscape-4.x Roaming Profiles (on a DAV-enabled server)

* Recognize platform-specific root directories (other than
leading slash) in mod_rewrite for filename rewrite rules.

* Disallow anything but whitespace on the request line after the
HTTP/x.y protocol string to prevent arbitrary user input from
ending up in the access_log and error_log. Also control characters
are now escaped.

* A large number of fixes in mod_proxy including: adding support
for dechunking chunked responses, correcting a timeout problem
which would force long or slow POST requests to close after 300
seconds, adding "X-Forwarded" headers, dealing correctly with the
multiple-cookie header bug, ability to handle unexpected
100-continue responses sent during PUT or POST commands, and a
change to tighten up the Server header overwrite bugfix.