HP-UX 11i June 2004 Release Notes

HP-UX 11i Version 1 Operating Environment Applications
HP-UX 11i v1 Foundation Operating Environment
Chapter 6
122
updated for
September 2003
HP-UX Apache-based Web Server v1.0.06.01 is primarily a security and bug-fix release
which addresses the following vulnerabilities and problems:
• Apache upgraded to 2.0.46, which addresses and fixes these security vulnerabilities
described at:
— http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0189
— http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0245
• mod_perl upgraded to 1.99_09: mod_perl has been upgraded in conjunction with
the Apache upgrade. Apache 2.0.46 and mod_perl 1.99_09 both depend on APR
version 0.9.4 (which is incorporated into Apache).
• Resolved problem causing mod_cgid with Chroot to fail.
• Corrected message, “unclean shutdown of previous Apache run,” generated during a
subsequent startup of Apache with Chroot turned on.
Plus enhancements from v1.0.05.01:
• mod_auth_ldap and its caching module, mod_ldap, have been added to provide
authentication to an LDAP directory. These are new modules from the Apache
Software Foundation. auth_ldap is still provided; however, all ldap users are
encouraged to begin transitioning to mod_auth_ldap. auth_ldap is provided during
this transition but will be removed in a future release.
Plus enhancements from v1.0.03.01:
• Apache upgraded to 2.0.45 which addresses and fixes these security vulnerabilities
described at:
— http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0132
— http://nagoya.apache.org/bugzilla/index.html: BUG # 17206
• Fixed OpenSSL 0.9.6i to address and fix these security vulnerabilities described at:
— http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0147
— http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0131
• Enabling more file descriptors:
HP-UX Apache-based Web Server is now compiled with _USE_BIG_FDS to raise the
maximum allowed number of simultaneous open files, or maximum number of file
descriptors, from 2048 to 60000 per process (depending on system configuration).
new for June 2003 HP-UX Apache-based Web Server v1.0.01.02 includes the following:
• OpenSSL upgraded to 0.9.6i, which addresses and fixes the security vulnerability
described at:
— http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0078
• Resolved a problem with Apache going into an infinite loop under certain network
conditions, consuming 100% CPU. The details regarding the bug is available at
http://nagoya.apache.org/bugzilla/index.html: BUG # 15380.
• Resolved a problem with Apache not able to load modules written in C++.