Apache Friends Support Forum

I have just installed XAMPP and have it working beautifully, well until today. I just failed a security scan and they say that I need to upgrade apache to the 2.2.10 version and I can't find it on XAMPP's site. I guess I am curious if I can simply update the apache by itself or if I need to wait for the XAMPP updated package to be released (which I hope it soon). Please any help would be greatly appreciated.

CAG

cag17 wrote:...I guess I am curious if I can simply update the apache by itself...

Not if you use XAMPP

cag17 wrote:...or if I need to wait for the XAMPP updated package to be released...

Yes - usually takes a short while after new XAMPP components are released, then an XAMPP beta is released so that any bugs found can be ironed out before the final new XAMPP version is released.

Beta page:
http://www.apachefriends.org/en/xampp-beta.html

There can be no set time schedule but you can be assured that the XAMPP developers will be working on new releases as soon as they humanly can.

After a little more digging I found some more information. I need to turn off mod_autoindex_color. Will this cause any problems for my site if I do this.

I need to turn off mod_autoindex_color.

Why?

I just failed a security scan and they say that I need to upgrade apache to the 2.2.10 version

There was no change in mod_autoexec between 2.2.9 and 2.2.10. Of cource, there was only one security related change in 2.2.10, regarding mod_proxy_ftp.

Will this cause any problems for my site if I do this.

Nobody here can know if you are using this module... (it's for the directory listings)

As for the why -- I am reading the results of a compliance scanner that we have to use and this module is said to have problems. The compliance results say to resolve the issue, upgrade to the new version but after reading about the module, I thought that it may be easier to turn it off. Is this true?

I am reading the results of a compliance scanner that

Which one and you have the complete result message?

I thought that it may be easier to turn it off. Is this true?

You can disable any Apache module (if you don't need it).