topic Re: Apache upgrade on HP-UX 11.31 in Operating System - HP-UX

Apache upgrade on HP-UX 11.31

jason_lee — Sun, 25 Oct 2009 13:56:38 GMT

Hi,
We have HP-UX 11.31, IA-64, with Apache 2.0.59. I believe Apache is used by SMH, anyone out there upgraded the Apached to V3? Is it supported (SMH)?

Point for useful idea.

Re: Apache upgrade on HP-UX 11.31

Steven E. Protter — Sun, 25 Oct 2009 18:03:05 GMT

Shalom,

Apache Version 3 is not offered by HP on http://software.hp.com . Therefore I have not tried it.

Now hpws, HP Web Suite version 3.0.6 is offered on the same website containing apache 2.2.

That works well for me. The httpd.conf file used in apache 2.0.x is compatible with acn can be used in apache 2.2

One could always try to compile the latest, greatest apache, but I would not try that. On HP-UX I stick with what HP provides, because it is tested by HP.

SEP

Re: Apache upgrade on HP-UX 11.31

Shinji Teragaito_1 — Mon, 26 Oct 2009 01:04:58 GMT

As of today, SMH supports only Apache 2.0.x in HP-UX Web Server
Suite v.2.x. If you want to use Apache 2.2.x in HP-UX WSS v.3.x
except for the use of SMH, you can install it additionally.

The installation directory is seperate:
/opt/hpws : WSS v2.x
/opt/hpws22 : WSS v3.x

Re: Apache upgrade on HP-UX 11.31

Torsten. — Mon, 26 Oct 2009 05:16:20 GMT

IMHO the SMH related apache is part of the SMH package itself.

Re: Apache upgrade on HP-UX 11.31

Shinji Teragaito_1 — Wed, 28 Oct 2009 05:04:40 GMT

SMH requires Apache in WSS v2.x as one of the prerequisites software.

% swlist -a prerequisites SysMgmtHomepage
...
SysMgmtHomepage.SMH-RUN openssl.OPENSSL-LIB hpuxwsAPACHE.APACHE,r>=B.2.0.49.00.%% hpuxwsAPACHE.AUTH_LDAP,r>=B.2.0.49.00.%% hpuxwsAPACHE.MOD_JK,r>=B.2.0.49.00.%% hpuxwsAPACHE.MOD_PERL,r>=B.2.0.49.00.%% hpuxwsAPACHE.PHP,r>=B.2.0.49.00.%% hpuxwsAPACHE.WEBPROXY,r>=B.2.0.49.00.%% SysMgmtBase.SMH-UILIB SysMgmtBase.SMH-UILIB-COM
...
%

I don't think Apache 2.2.x (hpuxws22Apache) in WSS v3.x is supported.

Re: Apache upgrade on HP-UX 11.31

jason_lee — Wed, 28 Oct 2009 12:24:15 GMT

So guys, what's the conlusion? I've to stick with Apache 2.0.59 in the HP-UX 11.31?

Have you guys heard of this "problem"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Apache < 2.0.63 Multiple XSS Vulnerabilities

According to its banner, the version of Apache 2.0 installed on the
remote host is older than 2.0.63. Such versions may be affected by several issues, including :

- A cross-site scripting issue involving mod_imap.
(CVE-2007-5000)

- A cross-site scripting issue involving 413 error pages
via a malformed HTTP method. (PR 44014 / CVE-2007-6203)

- A cross-site scripting issue in mod_status involving the
refresh parameter. (CVE-2007-6388)

- A cross-site scripting issue using UTF-7 encoding in
mod_proxy_ftp exists because it does not define a
charset. (CVE-2008-0005)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
So, how can I solve this problem?

Re: Apache upgrade on HP-UX 11.31

Torsten. — Wed, 28 Oct 2009 13:21:46 GMT

The latest I can currently find is https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXWSATW306

but have yourself a look at http://software.hp.com

Re: Apache upgrade on HP-UX 11.31

Duncan Edmonstone — Wed, 28 Oct 2009 13:32:21 GMT

If you are asking can you install a newer version of Apache onto HP-UX than 2.0.x, the answer is of course yes, and the latest available version is 2.28.05:

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXWSATW306

If you are asking if you can *remove* the older version and still have SMH work, then the answre is _no_ - see the release notes for the latest version of SMH here:

http://docs.hp.com/en/466303-004/ch03s01.html

Specifically:

---------------------------------------
HP SMH does not work if Apache 2.0 is removed. This issue occurs because HP SMH requires Apache 2.0 to be installed. While you can migrate to Apache 2.2, HP SMH 3.0 works only with Apache 2.0.

The workaround is that you can have both Apache versions 2.0 and 2.2 on the same system. The two versions can coexist since they execute from different paths. Apache 2.0 runs from the path /opt/hpws whereas Apache 2.2 runs from the path /opt/hpws22.

The current version of HP SMH runs using only Apache 2.0 which executes from the path /opt/hpws. Even if Apache version 2.2 is installed, SMH works well without any conflicts. This is because Apache runs using port number 80 whereas HP SMH runs using port number 2301 and 2381. Even when multiple instances of Apache are operating, SMH works by using its own instance of only Apache version 2.0.

---------------------------------------

As to the specific issues you have identified (presumably from some security auditing/scanning tool) - they are all addressed in the latest version of 2.0.x

CVE-2007-5000,CVE-2007-6388 - fixed in 2.0.59.04

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXWSATW219

CVE-2007-6203,CVE-2008-0005 - fixed in 2.0.59.12:

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXWSATW227

And of course the later release will include the fixes from the previous release... so 2.0.59.12 does not suffer from the issues you identified.

HTH

Duncan

Re: Apache upgrade on HP-UX 11.31

jason_lee — Mon, 02 Nov 2009 12:52:18 GMT

Hi,
I still wonder how can I upgrade? Is it download the version & just install it over the existing one? Anyone done it before? i.e. upgrade the Apache in HP-UX 11.31.

Jason.

Re: Apache upgrade on HP-UX 11.31

Steven E. Protter — Mon, 02 Nov 2009 13:23:04 GMT

Shalom,

This depot will do an overwrite install.

swinstall the new version, everything should be okay.

If you have customized httpd.conf or other configuration files, back them up prior to this so they don't get whacked.

SEP