Security News > 2021 > October > Apache web server zero-day bug is easy to exploit – patch now!
The venerable Apache web server has just been updated to fix a dangerous remote code execution bug.
This bug is already both widely-known and trivial to exploit, with examples now circulating freely on Twitter, and a single, innocent-looking web request aimed at your server could be enough for an attacker to take it over completely.
Any software product you use that has its own HTTP interface, such as a document management system or a support ticketing system, might, for all you know, be using Apache as its built-in web server.
Simply put, a path traversal bug happens when a user tries to access a file on the server that ought to be considered off-limits, but the security check on the location of the file fails.
All security conscious software, especially including web servers, needs to be on the lookout for this sort of trickery.
Initial reports correctly implied that this bug was exploitable for reading files that were off-limits, including files outside the web server's own directory tree, as well as script files inside the server tree that were not supposed to be directly accessible.
News URL
Related news
- Rackspace internal monitoring web servers hit by zero-day (source)
- 'Patch yesterday': Zimbra mail servers under siege through RCE vuln (source)
- Qualcomm Urges OEMs to Patch Critical DSP and WLAN Flaws Amid Active Exploits (source)
- Microsoft October 2024 Patch Tuesday fixes 5 zero-days, 118 flaws (source)
- Finland seizes servers of 'Sipultie' dark web drugs market (source)
- North Korean ScarCruft Exploits Windows Zero-Day to Spread RokRAT Malware (source)
- VMware fixes bad patch for critical vCenter Server RCE flaw (source)
- Exploit released for new Windows Server "WinReg" NTLM Relay attack (source)
- Hackers exploit 52 zero-days on the first day of Pwn2Own Ireland (source)
- Lazarus hackers used fake DeFi game to exploit Google Chrome zero-day (source)