centos 5.4 need to update apache/httpd
 

Here goes; One of our production servers is running Apache 2.2.11-7, and we have some open vulns that need it to upgrade to 2.2.15.

Steps:
--------
use yum (LOVE yum)

1. yum update
2. yum update httpd - "No Packages marked for Update"
3. yum list installed httpd - "Installed Package httpd.x86_64 2.2.11-7 installed"

Does this mean I have to manually install from src if I want to get apache upgraded, since I can't seem to find a 2.2.15 version of apache on rpmfind.net?

Also, if there are vulns, why can't yum update yet?

CentOS uses older version of the software. Maybe this version, which you need is not included yet.

How did you determine this? Did you perform some sort of vulnerability scan, or are you going solely by the version numbers? If it's the latter, keep in mind that it's quite normal for distros to leave software version numbers intact when backporting security patches (the package version number is what gets bumped). Have you checked the relevant package's changelog to see if there is a record of the vulnerabilities you're referring to having been addressed?

We have a 3rd party doing a Qualys PCI scan. It's very frustrating, because it seems they are only going off version number, and i really, really do not like installing from src if I don't have to.

I think i found a solution - I updated everything possible, and then changed my httpd.conf to not reflect the Apache version.

httpd.conf
And test it by:

Still waiting for the scan to come back before I mark it as SOLVED.

You should explain to them that what they are doing is extremely stupid.

If they force you to needlessly upgrade software you are more likely to introduce new security bugs. For production servers backporting the fixes (as is done in RHEL/CentOS, Debian etc.) is the way to go. If they (the 3rd party) don't understand this then I shudder to think what else they screw up.

Good luck!

Evo2.

Bingo. Your scan is giving bogus results because it doesn't account for this.

[SOLVED] centos 5.4 need to update apache/httpd
 

By simply removing the Apache version in the header information, it was enough to trick Qualys into believing we're up to date, and or actually trying the vuln. Anyways - we're in the clear - thanks guys!