Updated Apache advisory and response from ISS

The Apache Software Foundation has issued an updated advisory on the "chunk handling" vulnerability. Now that a 32-bit remote exploit is circulating, an Apache upgrade is suggested even more urgently than before.

Meanwhile, ISS has sent out a response to the extensive criticism it has taken for having announced the vulnerability without allowing the ASF (or anybody else) any time to prepare patches. "Due to the general nature of open-source and its openness, the virtual organizations behind the projects do not have an ability to enforce strict confidentiality. By notifying the open source project, its nature is that the information is quickly spread in the wild disregarding any type of quiet period. ISS X-Force minimizes the quiet period and delay of protecting customers by providing a security patch." If you haven't already, see this week's Leading Items for our opinion.

See the vulnerability report for current information on this problem and distributor alerts.

---

(Log in to post comments)