Mod_SSL

Problems with the Windows version of XAMPP, questions, comments, and anything related.

Mod_SSL

Postby CBman » 22. November 2011 21:25

We recently went through our yearly security review of a website we are running on Xampp with Joomla and had a question concerning the version of Mod_ssl included with Xampp.

According to PHPinfo, the version of Mod_ssl in use is "2.2.21". Since the Mod_ssl crew never mentions this exact version number, but it does exactly match the Apache version, i assume that the version reported is not entirely accurate.

I need to to confirm what version of Mod_ssl is included, then if necessary upgrade to the version specified below.

Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1


Vulnerability Solution:
Download and apply the upgrade from: http://www.modssl.org/
Upgrade to version 2.8.19 of mod_ssl, which was released on July 16th, 2004.
The source code for this release can be downloaded from mod_ssl's website. To obtain binaries for your platform, please visit your vendor's site. Please note that some operating system vendors choose to apply the most recent mod_ssl security patches to their distributions without changing the package version to the most recent mod_ssl version number.
CBman
 
Posts: 2
Joined: 22. November 2011 20:53
Operating System: Windows 2003 server

Re: Mod_SSL

Postby JonB » 22. November 2011 22:23

Please note that page refers to an out of date Apache version -

Current Version: mod_ssl 2.8.31 for Apache 1.3.41

Good Luck
8)
User avatar
JonB
AF Moderator
 
Posts: 3210
Joined: 12. April 2010 16:41
Location: Land of the Blazing Sun
Operating System: Windows XP/7 - Fedora 15 1.7.7

Re: Mod_SSL

Postby CBman » 22. November 2011 22:31

Yes, i'm aware. It hasn't been updated since 2008.

However for our compliance review i need to know what version is being used. The site we are running does require SSL and strict security due to the nature of the content.

Sadly, they will not accept "Sure it's out-dated, but it's more secure than Apache-ssl"
CBman
 
Posts: 2
Joined: 22. November 2011 20:53
Operating System: Windows 2003 server

Re: Mod_SSL

Postby hackattack142 » 22. November 2011 23:30

To put it plainly, if you have the latest Apache 2.x installed then you should have the latest mod_ssl. The version number shown is the version of mod_ssl included. You should ignore what you see on the modssl.org site (including the version numbers) as it is old and only applies to Apache 1.3.x as said. Mod_ssl for Apache 2 is bundled with the Apache source and it is built when Apache is compiled. As far as I can tell, they are being maintained together and you will probably not find it separate, at least for Windows (I cannot speak for the Linux side). XAMPP 1.7.7 has the latest Apache 2.2 included so you should also have the latest mod_ssl.
XAMPP Control Panel Developer
Latest CP: viewtopic.php?f=16&t=48932
hackattack142
 
Posts: 703
Joined: 20. May 2011 23:29
Operating System: Windows 7 Ultimate SP1 64-Bit

Re: Mod_SSL

Postby Sharley » 23. November 2011 01:18

@CBman
If you go to \xampp\apache\modules folder and find mod_ssl.so...
(the Apache module used in the 1.7.7 XAMPP release)

...and right click on it then select Properties.

Next select the Version tab where you will find all the relevant details you are seeking from within the module file.
(A good hex editor will also reveal the file's content).

Best wishes. :)
User avatar
Sharley
AF Moderator
 
Posts: 3316
Joined: 03. October 2008 05:10
Location: Yeppoon, Australia Time Zone: GMT/UTC+10
Operating System: Win 7 Pro 32bit/XP Pro SP3


Return to XAMPP for Windows

Who is online

Users browsing this forum: No registered users and 61 guests