mod_proxy security issues

Question

A friend is asking me about mod_proxy modules ,

They have a server that was recently attacked using mod_proxy and after checking his logs he said he wasn't vulnerable to those attacks since they have a newer version ...

So to avoid any further attack he's asking if those modules are needed on the server :

mod_proxy.so
mod_proxy_connect.so
mod_proxy_ftp.so
mod_proxy_http.so
mod_proxy_ajp.so
mod_proxy_balancer.so

or he can remove them safely ...

Thank you !

Answer 1

Is mod_proxy in use? Look for any directives in the config that start with the word Proxy; that'll tell you what will break if mod_proxy is disabled.

As far as the specific attacks and vulnerabilities, we would need to know the details around what the attack was.

Answer 2

www.securityfocus.com - search the archives.