5 ms·

You can't really tell by the version number. For example Debian stable has Apache 2.2.22 but with security patches back-ported from Apache 2.2.29. It is quite c

• ForFreedom 12y ago
  What if malware was uploaded to the websites because of the outdated apache?
  • SwellJoe 12y ago
    Was it? If they are running the latest version from the distro vendor, and the distro vendor has maintained the software, the version should be fine. Most major Linux distributions distribute the same version of a package throughout a life cycle (i.e. CentOS 6 will have the same version of Apache for its entire 5+ years of maintained life), with backported security fixes and occasional bugfixes. That is not a bug, it's a feature. I'm not saying the Apache isn't exploitable, but you need to know more than the Apache version. You'd need to know the distro package version information, and compare it to the latest package available from the distro installed on the server.
  • mortenlarsen 12y ago
    Well you can't really know, if it is outdated or if it has back-ported patches. But chances are that your webhost is telling you the truth, and that it is not outdated from a security perspective. They are probably running Debian.
    • ForFreedom 12y ago
      They are running debian, so it means there is no security breach?
      • mortenlarsen 12y ago
        Yes. At least not anything that would be fixed by running a newer version.