3

How can I update my httpd version 2.4.6 to 2.4.10? If I try to update it with yum, it says that I have the latest version. I want to update httpd to 2.4.10 version because a security issue of the mod_proxy module (I need to use that module). If I configure the apache using that module, the network traffic uses all my bandwidth. As soon as I comment out the concerned lines and restart the httpd service, the network traffic goes back to normal bandwidth traffic.

These are the lines that I commented out, and then everything work well:

LoadModule proxy_module modules/mod_proxy.so

ProxyRequests On

ProxyPass / http://xxx.xxx.xxx.xxx/
ProxyPassReverse / http://xxx.xxx.xxx.xxx/

(The ip address was xxx'ed in order to not showing it)

May be of interest, my server version:

Server version: Apache/2.4.6 (CentOS)
Server built: Jan 12 2015 13:22:31
Server's Module Magic Number: 20120211:23
Server loaded: APR 1.4.8, APR-UTIL 1.5.2
Compiled using: APR 1.4.8, APR-UTIL 1.5.2
Architecture: 64-bit
Server MPM: prefork
threaded: no
forked: yes (variable process count)

Any suggestion?

12
  • 1
    The security fix was probably backported to that version of httpd. If you know the CVE number you can verify by look up in the Red Hat CVE database to see what version Red Hat fixed the issue in. – Bratchley Mar 30 '15 at 14:02
  • I just searched through all known CVE's and the latest CVE I was able to find related to mod_proxy was back in July of last year. Here is the RH bulletin for it. Says it was resolved in httpd-2.4.6-18. – Bratchley Mar 30 '15 at 14:12
  • It also might help if you show us what lines you're commenting out. It's possible the CVE is unrelated to your actual issue. – Bratchley Mar 30 '15 at 14:14
  • Thanks! These are the lines that I commented out, and then everything work well: LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_balancer_module modules/mod_proxy_balancer.so LoadModule proxy_ftp_module modules/mod_proxy_ftp.so LoadModule proxy_http_module modules/mod_proxy_http.so LoadModule proxy_ajp_module modules/mod_proxy_ajp.so LoadModule proxy_connect_module modules/mod_proxy_connect.so RewriteEngine on (Continues on next comment) – Fernando Pap Mar 30 '15 at 14:32
  • (Continued) RewriteCond %{HTTP_HOST} ^somesite.gov.ar$ [OR] RewriteCond %{HTTP_HOST} ^www.somesite.gov.ar$ [OR] RewriteCond %{HTTP_HOST} ^somesite.gob.ar$ RewriteRule (.*) http://www.somesite.gob.ar$1 [R=301,L] ProxyRequests On ProxyPass / http://xxx.xxx.xxx.xxx/ ProxyPassReverse / http://xxx.xxx.xxx.xxx/ (The ip address was xxx'ed in order to not showing it) – Fernando Pap Mar 30 '15 at 14:32
0

Solved! From askapache: "Do Not set "ProxyRequests On". Setting ProxyRequests On turns yourserver into an Open Proxy. There are 'bots scanning the Web for openproxies. When they find you, they'll start using you to route aroundblocks and filters to access questionable or illegal material. Atworst, they might be able to route email spam through your proxy. Yourlegitimate traffic will be swamped, and you'll find your servergetting blocked by things like family filters."

So, the only line to be changed is ProxyRequests On, it should be ProxyRequests Off.

Greetings and thank you for the help!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.