Not so simple as "Apache is a monoculture"

Not so simple as "Apache is a monoculture"

Posted Jun 20, 2002 17:50 UTC (Thu) by bjn (guest, #2179)
Parent article: The Apache vulnerability, full disclosure, and monocultures

This vulnerability, like many others, is a stack overflow. Such vulnerabilities are very sensitive to the hardware architecture, operating system, and compiler. Unlike IIS (which runs on only one OS, and only one hardware architecture), Apache runs on many OSes, and many hardware architectures, and is compiled with many compilers. I wouldn't call that a monoculture (w.r.t security), since it is much harder to write an exploit that will work on all of them.

I would expect the more popular variations (Red Hat Linux on Intel, for example) to be widely attacked; but I doubt any attack tool is going to reach a majority of the Apache servers worldwide.

---

(Log in to post comments)