VMS, Apache vuln version

[ibanezm]

Is there VMS documentation addressing the Apache vulnerabilities in versions earlier than 1.3.33 (ref http://www.apacheweek.com/features/security-13). I understand the latest VMS version is running Apache 1.3.27.

[gfullage]

Apache v1.3.33 fixes 2 potential security issues:

CAN-2004-0940 (cve.mitre.org) :Fix potential buffer overflow with escaped characters in SSI tag string.

This vulnerability is applicable, only if the Apache Server has SSI (Server-side Include) feature enabled. VMS does not enable SSI, so we are not affected by this.

CAN-2004-0492 (cve.mitre.org) :Reject responses from a remote server if sent an invalid (negative) Content-Leng

This vulnerability is applicable in mod_proxy module only if the Apache Server is configured as a proxy. But we are not using mod_proxy module in

CiscoWorks so again, we are not affected.

Hope that helps.

[ibanezm]

gfullage - Thanks for the detailed answer. That answers the question.

mai