Security News > 2021 > October > Apache web server zero-day bug is easy to exploit – patch now!
The venerable Apache web server has just been updated to fix a dangerous remote code execution bug.
This bug is already both widely-known and trivial to exploit, with examples now circulating freely on Twitter, and a single, innocent-looking web request aimed at your server could be enough for an attacker to take it over completely.
Any software product you use that has its own HTTP interface, such as a document management system or a support ticketing system, might, for all you know, be using Apache as its built-in web server.
Simply put, a path traversal bug happens when a user tries to access a file on the server that ought to be considered off-limits, but the security check on the location of the file fails.
All security conscious software, especially including web servers, needs to be on the lookout for this sort of trickery.
Initial reports correctly implied that this bug was exploitable for reading files that were off-limits, including files outside the web server's own directory tree, as well as script files inside the server tree that were not supposed to be directly accessible.
News URL
Related news
- Apache fixes remote code execution bypass in Tomcat web server (source)
- November 2024 Patch Tuesday forecast: New servers arrive early (source)
- Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 91 flaws (source)
- Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws (source)
- Botnet exploits GeoVision zero-day to install Mirai malware (source)
- Mystery Palo Alto Networks hijack-my-firewall zero-day now officially under exploit (source)
- Chinese hackers exploit Fortinet VPN zero-day to steal credentials (source)
- Apple Releases Urgent Updates to Patch Actively Exploited Zero-Day Vulnerabilities (source)
- RomCom Exploits Zero-Day Firefox and Windows Flaws in Sophisticated Cyberattacks (source)
- Hackers exploit ProjectSend flaw to backdoor exposed servers (source)