NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
ReadyNAS 516 - Failing Security Scan as End Of Life with Apache 2.2.34 , Need to Upgrade to 2.4.x
When running a security scan on the ReadyNAS 516 it comes up with a security issue due to Apache 2.2.x reaching end of life. I have updated to the most current firmware but it looks like Apache is still out of date. What can be done to get Apache to 2.4.x so that the system will pass a security audit?
Current firmware: 6.9.3
TCP: 443: Product : Apache 2.2.x
Server response header : Apache/2.2.34 (Debian)
Supported versions : Apache HTTP Server 2.4.x
Additional information : http://archive.apache.org/dist/httpd/Announcement2.2.html
TCP: 80: Product : Apache 2.2.x
Server response header : Apache/2.2.34 (Debian)
Supported versions : Apache HTTP Server 2.4.x
Additional information : http://archive.apache.org/dist/httpd/Announcement2.2.html
6 Replies
Replies have been turned off for this discussion
We are evaluating upgrading to apache 2.4 but have no imminent plans for an update to this.
If you try updating it yourself there’s a strong chance it will break the http/s service for the NAS. You could experiment using the VM.
mdgm,
This puts us into a predicament, we cannot have it fail a security audit but also cannot remove it at this time. What do you mean by experiment using the vm? If we were to upgrade and say it broke HTTP/s, would there be a way to revert the upgrade and not lose the data?
Upgrading from 2.2 to 2.4 would be a major undertaking. It's not just a matter of updating packages it's also updating the configuration and making sure that the appropriate configuration is set when changes are made in the GUI etc.
We do backport patches from various packages as we need to from time to time.
Also whilst most of the apache2 packages we use are the 2.2.x version, we do use a 2.4.x version of apache2-utils
In any case we don't recommend making http/s on the NAS publicly accessible on the internet and you should only allow those you trust to access your LAN.
You can run ReadyNAS OS 6 in a Virtual Machine. If you're going to experiment it's better to replicate your setup (apps etc.) and experiment with that rather than on a production system.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
