Ask HN: Apache 2.2.22 is outdated but not according to the webhost
After much debate with my web host Apache 2.2.22 outdated from a security scan but not according to the webhost.
Is it really not outdated as the web host says?
Is it really not outdated as the web host says?
If they are running the latest version from the distro vendor, and the distro vendor has maintained the software, the version should be fine. Most major Linux distributions distribute the same version of a package throughout a life cycle (i.e. CentOS 6 will have the same version of Apache for its entire 5+ years of maintained life), with backported security fixes and occasional bugfixes. That is not a bug, it's a feature.
I'm not saying the Apache isn't exploitable, but you need to know more than the Apache version. You'd need to know the distro package version information, and compare it to the latest package available from the distro installed on the server.
Still have boxes with apache 1.3 running, but all potential vulnerabilities are patched and or bad feature(s) removed.
Bottomline i think is, you are unhappy with your web host. Find another that does match your particular preference.
Well my question to them was how can that be that I have malware and its okay for them to have outdated web server software.
I asked them for patch dates :: didnt get a reply They said if they upgrade then all users will have problems with their websites.
I have been hosting with them for over 5 years now and they are good.
I may be wrong in my opinion or have over looked something so wanted to know what others think.
If you believe your hosting company is lying then staying there is not a sensible decision to make.
Your server/site could be compromised. There could be malware present. That may or may not be related to the version of Apache.
Most web-compromises are due to weak SSH passwords, old versions of Wordpress, or other applications. I've never yet seen a compromised host which was caused by an old version of Apache, but that isn't to say that this is impossible.
The scanner most likely does a simple version compare. The scanner assumes anything under version X.Y == vulnerable. If it would be hiding or faking the vendor and version to latest IIS (or apache, or nginx or etc), possible it would simply report all is A-Okay. Unless the scanner really test the actual exploit/vulnerabilities, i assume the simple version compare happens.
Though i'm quite certain the malware didn't get *there via a method that only utilises the webserver; more likely a poor coded (php, perl, etc) script allowed 3rd parties to download/write to disk of your webserver.
If for example shellshock wasn't patched in time, and there was a vulnerable cgi script or similar on the website/server, it could have been that script+bash, that has been exploited. But that doesn't make the webserver vulnerable. (even though the malicious upload/ action was executed via the webserver)