topic Re: HPUX SMH apache version in Operating System - HP-UX

HPUX SMH apache version

Jonathan Grymes — Mon, 16 Feb 2009 20:54:07 GMT

The apache version behind HPUX SMH is version 2.0.58 located in /opt/hpws/apache/bin/httpd. There are multiple vulnerabilities with this old version of apache. Is an HPUX upgrade version available?

Re: HPUX SMH apache version

Robert-Jan Goossens — Mon, 16 Feb 2009 21:17:07 GMT

Hi Jonathan,

I don't think you need that specific apache version in combination with SMH.

http://docs.hp.com/en/438862-003/ch04s04.html

http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXWSATW302

Regards,
Robert-Jan

Re: HPUX SMH apache version

Steven E. Protter — Mon, 16 Feb 2009 21:45:11 GMT

Shalom,

There are lots of updates on http://software.hp.com

There will always be vulnerabilities and unless you are internet exposed you can take your time on deployment.

SEP

Re: HPUX SMH apache version

Jonathan Grymes — Mon, 16 Feb 2009 23:14:16 GMT

I did upgrade HP SMH to the latest version, 2.2.9.1. However, that had no impact on the Apache based web server.

# /opt/hpws/apache/bin/httpd -v
Server version: Apache/2.0.58 HP-UX_Apache-based_Web_Server
Server built: Dec 18 2006 16:20:06
#

Re: HPUX SMH apache version

Shinji Teragaito_1 — Tue, 17 Feb 2009 00:09:02 GMT

Because the Apache you installed is present under /opt/hpws22/apache.

Note: you can't use Apache 2.2.* with HP-UX SMH. As of today, SMH supports only Apache 2.0.*. So I'd recommend to use Apache-based Web Server v.2.22.

Shinji

Re: HPUX SMH apache version

Shinji Teragaito_1 — Tue, 17 Feb 2009 04:59:51 GMT

This may help you.

SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01650939
HPSBUX02401 SSRT090005 rev.2 - HP-UX Running Apache Web Server Suite,
Remote Denial of Service (DoS), Cross-site Scripting (XSS), Execution
of Arbitrary Code, Cross-Site Request Forgery (CSRF)
Release Date: 2009-02-02
Last Updated: 2009-02-12

Shinji