apache core

I am running apache 1.3.22 and mod_ssl-2.8.5-1.3.22, and have had a few
cores recently. They all have the same backtrace:

(gdb) whe
#0 0x28158f57 in ssl3_write_bytes () from /usr/lib/libssl.so.2
#1 0x28158e68 in ssl3_write_bytes () from /usr/lib/libssl.so.2
#2 0x28158b58 in ssl3_write_bytes () from /usr/lib/libssl.so.2
#3 0x2815a641 in ssl3_write () from /usr/lib/libssl.so.2
#4 0x28156698 in SSL_write () from /usr/lib/libssl.so.2
#5 0x80839bf in SSL_writev ()
#6 0x80838b0 in ssl_io_hook_writev ()
#7 0x80e1517 in ap_hook_call_func ()
#8 0x80e0c28 in ap_hook_call ()
#9 0x80bd16c in writev_it_all ()
#10 0x80bd5c3 in large_write ()
#11 0x80bd697 in ap_bwrite ()
#12 0x80d012f in ap_send_mmap ()
#13 0x80c6212 in default_handler ()
#14 0x80be9c8 in ap_invoke_handler ()
#15 0x80d37ac in process_request_internal ()
#16 0x80d3816 in ap_process_request ()
#17 0x80ca6af in child_main ()
#18 0x80ca958 in make_child ()
#19 0x80cacdc in perform_idle_server_maintenance ()
#20 0x80cb259 in standalone_main ()
#21 0x80cb8a4 in main ()
#22 0x805a549 in _start ()

I don't have symbols so it's a little hard for me to see what's happening,
but I thought I'd see if this is a known issue.

I've tried to recompile my httpd with symbols but when I do that and run
"gdb httpd " the backtrace seems to change. I don't think that's
normal, so I suspect I'm doing something wrong.

Any help in tracking this down is appreciated.

Thanks,
-Lance

____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

Re: apache core

On Wed, 16 Oct 2002, Lance Uyehara wrote:

> I am running apache 1.3.22 and mod_ssl-2.8.5-1.3.22, and have had a few
> cores recently. They all have the same backtrace:

You're probably being probed by the openssl worm. You need to upgrade to
all the latest versions, as there are a number of remotely exploitable
flaws in the versions you have.

--Cliff

____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

Re: apache core

At 03:50 PM 10/16/02 -0400, Cliff Woolley wrote:
>On Wed, 16 Oct 2002, Lance Uyehara wrote:
>
> > I am running apache 1.3.22 and mod_ssl-2.8.5-1.3.22, and have had a few
> > cores recently. They all have the same backtrace:
>
>You're probably being probed by the openssl worm. You need to upgrade to
>all the latest versions, as there are a number of remotely exploitable
>flaws in the versions you have.

Thanks! I really appreciate the quick response.

-Lance

____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org