Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> Can the latest Apache be used in Oracle 
        
(Message started by: Pete Finnigan on Sep 9^th, 2005, 3:33pm)

Title: Can the latest Apache be used in Oracle
Post by Pete Finnigan on Sep 9^th, 2005, 3:33pm

Hi everyone,

Does enyone know the position with substituting the version of Apache included with the database for the latest version from Apache.org?

I have never tried to do it myself and I have found conflicting reports on the net about others who have tried. Some claim to have got it to work othres not. Also what is Oracles position in substituting the Apache version? - I would guess that they have made mods that are needed for it to function with the database?

Also what about current Apache patches? - its known that the Oracle version of apache is older than the real version. does anyone have real world experience with Apache patches and substitutions?

cheers

Pete

Title: Re: Can the latest Apache be used in Oracle
Post by Pete Finnigan on Sep 14^th, 2005, 2:59am

Pete,

I asked this question about 1.5 years ago to the product manager (at that time) of the iAS (Apache) product.

When pressed about the reason I would want to upgrade (the nerve!), he told me emphatically that the version of Apache at that time had all it's security flaws addressed and that version 2.4x was less secure than the version they ship.

He told me there are many modules that would need to be manually added and that we would not get support if we changed the Apache version.

I have used Apache 2.48 (I think that was the version) with a current, modern version if Perl, DBI, and DBD::Oracle against Oracle 9.2 without issue (CGI code), but never have tried to get the entire iAS suite running under it.

Sorry I cannot give you something else.

- Ron Reidy

Title: Re: Can the latest Apache be used in Oracle
Post by Pete Finnigan on Sep 17^th, 2005, 7:52pm

Hi Ron,

Thanks very much for your insight into the situation. I suspected that this is the true case. So even though it is most liklely possible to get the latest version running, it needs to be modded to add the Oracle changes and it is *almost certainly more secure* !, the bottom line being Oracle will not support you. I am not talking about the full iAS stack though.

Thanks for your guidance Ron,

cheers

Pete