Secunia

Three vulnerabilities have been identified in Apache 1.3, one allows malicious people to cause Apache to stop logging requests.

1) Apache fails to handle "0x1A" characters when configured to use "rotatelogs". This could be exploited to cause Apache to stop logging requests to access and error logs, this could hide other malicious activity.

This has only been reported to affect Apache 1.3.27 on Microsoft Windows and IBM OS/2 platforms which has been configured to pipe log information to "rotatelogs".

2) A potential Denial of Service condition exists because the server could enter an infinite loop due to internal redirects. The problem is that a malicious type-map file may cause an infinite number of redirections, causing the server to consume all available CPU resources.

3) Several file descriptors are leaked to child processes such as CGI scripts. This is an older issue which previously has been fixed in the Apache 2.0 branch. See:
http://secunia.com/advisories/8499/

Solution
Apache 1.3.28 has been released:
Further details available in Customer Area

Provided and/or discovered by
Hitachi Incident Response Team (reported the logging issue)

Original Advisory
http://www.apache.org/dist/httpd/Announcement.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area