Find used Apache:

$ which -a httpd
/usr/local/bin/httpd
/usr/sbin/httpd

$ whereis httpd
/usr/sbin/httpd

which shows you both of your apache, whereis shows you the currently used apache

Internal Apache

• Binary: /usr/sbin/httpd
• Start/Stop: sudo /usr/sbin/apachectl start
• Version: /usr/sbin/apachectl -v
• Config: /etc/apache2/httpd.conf

Homebrew Apache

• Binary: /usr/local/bin/httpd (symlink to ../Cellar/httpd)
• Start/Stop: sudo /usr/local/bin/apachectl start
• Version: /usr/local/bin/apachectl -v
• Config: /usr/local/etc/httpd/httpd.conf

Homebrew Apache (Apple Silicon)

substitute /opt/homebrew for /usr/local in the group directly above. for example

• Binary: /opt/homebrew/bin/httpd (symlink to ../Cellar/httpd)
• Start/Stop: sudo /opt/homebrew/bin/apachectl start
• Version: /opt/homebrew/bin/apachectl -v
• Config: /opt/homebrew/etc/httpd/httpd.conf

Note: For me the Internal and the Homebrew Apache are at the same Version.

Two things here, how to set the default apache version, and whether your machine is vulnerable.

firstly, you can have multiple versions of apache installed, and even running simultaneously (listening on different ports). Installing homebrew apache, doesn't necessarily start the server automatically, or deactivate the default (apple) apache install.

You can see which versions of apache are running on your system by using the ps command, for example on my machine:

$ ps auxw | grep  httpd
_www               782   0.0  0.0 34153280   1476   ??  S    26May22   0:00.83 /usr/sbin/httpd -D FOREGROUND

and check the version:

$ /usr/sbin/httpd -v
Server version: Apache/2.4.53 (Unix)

The apple httpd service is started by launchctl, and you can stop the apple httpd service from automatically starting up as follows:

$ sudo launchctl unload -w /System/Library/LaunchDaemons/org.apache.httpd.plist

To automatically start homebrew apache on system startup (assuming you have already installed it - brew install httpd), run brew services start httpd

Remember that the apache configuration files will be in a different location - apple conf file is /etc/apache2/httpd.conf, whereas homebrew's is in /usr/local/etc/httpd/httpd.conf. Also the default port may well be different - apple defaults to port 80 whereas homebrew httpd listens on port 8080 by default.

Secondly, does this security issue actually matter? By default apache listens on all network interface, but unless you need to access the web server from another machine, it is safer to configure it to only listen on localhost. You can do this in the httpd.conf file, as follows:

Listen 127.0.0.1:80

This page has a good walkthrough of the various steps: https://wpbeaches.com/installing-configuring-apache-on-macos-using-homebrew/

Either rpm -q httpd or /usr/sbin/httpd -v should work.

How about in the apachectl wrapper script you stick something like this at the end.

tail -5 /var/log/httpd/error_log

you should see something like this in a normal startup

• [Fri Apr 22 23:39:20 2011] [notice] Digest: generating secret for
  digest authentication ...
• [Fri Apr 22 23:39:20 2011] [notice] Digest: done
• [Fri Apr 22 23:39:20 2011] [warn] pid file
  /mlk/apache/pid/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
• [Fri Apr 22 23:39:20 2011] [notice] Apache/2.0.63 (Unix) DAV/2 configured -- resuming normal operations

Otherwise any error should at least in part be shown here. The key phrase is hilighted above.

Additional: /usr/sbin/apachectl is owned by root, you must be a privileged user to do this. sudo vi /usr/sbin/apachectl

move to the end of the file and insert this between the "esac" and "exit $ERROR" lines. ie.

esac
sleep 2; tail -5 /var/log/httpd/error_log
exit $ERROR

Note this will print out the last few lines no matter what action you take with the script, stop start, restart. you may want to only put it in the start part of the case statement.

You first need to find out where are those binaries stored. For this you may use the whereis command.

whereis httpd

The output will give you the different path for the files httpd like this:

httpd: /usr/sbin/httpd /usr/lib64/httpd /etc/httpd /usr/share/httpd /usr/share/man/man8/httpd.8.gz

Then, for the binaries, you can check the version using the path with the attribute -v

/usr/sbin/httpd -v

Output:

Server version: Apache/2.4.6 (CentOS)
Server built:   Oct 19 2017 20:39:16

---

For the yum installed version, you may also use the following command:

sudo yum list installed httpd
Installed Packages
httpd.x86_64                          2.4.6-67.el7.centos.6

---

Another last solution is to use: rpm -q httpd

Hey @R_C What wound up happening with this at your org?  We're also using Tenable and this (along with newer versions) are being flagged as a high. Curious to know if this was a false-positive for MacOS endpoints and how you handledIt's somewhat of a false positive. Whereas it is a vulnerability, httpd is default disabled unless otherwise enabled. Command to Disable Apache\\httpd/bin/launchctl disable system/org.apache.httpd Command to check whether Apache\\httpd is enabled:/bin/launchctl print-disabled system | /usr/bin/grep -c '"org.apache.httpd" => true'

I managed to fix this

I ran ps aux | grep apache to see the apache processes

I then ran sudo apachectl stop

Then sudo killall -9 httpd to kill all apache processes

Then sudo apachectl restart

I went to the browser and typed localhost~/username/sitename

Bingo it works again, my system is using the correct version of apache again!