Screaming Penguin - Source Does Matter

Some time back all versions of OpenSSL prior to 0.9.6e were found to have buffer overflow vulnerabilities. This was quickly addressed and patches to OpenSSL were made available right away. However, it appears that many people did not rebuild their apache server binaries that may have been originally build or linked with the vulnerable OpenSSL code. This includes mod_ssl, apache_ssl, etc. There is now a WORM IN THE WILD that can exploit these apache servers. It is important to note that this is a flaw in OpenSSL and it is important to understand that apache is vulnerable if flawed OpenSSL was used in building it.

See the linked LinuxSecurity.com story and read the CERT advisories.   OpenSSL Worm Loose in the Wild