Full Disclosure mailing list archives
Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192)
From: Dirk-Willem van Gulik <dirkx () webweaving org>
Date: Fri, 26 Aug 2011 12:34:13 +0100
On 26 Aug 2011, at 12:09, Carlos Alberto Lopez Perez wrote:
RewriteEngine on RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$) [NC,OR] RewriteCond %{HTTP:request-range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$) [NC] RewriteRule .* - [F] Because if you don't specify the [OR] apache will combine the rules making an AND (and you don't want this!). Also use NC=(nocase) to prevent the attacker upper casing "bytes=" (don't know if it will work.. but just to prevent)
Thank you - will double check & add in next/final advisory. Dw. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Dirk-Willem van Gulik (Aug 25)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Anestis Bechtsoudis (Aug 26)
- <Possible follow-ups>
- Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Dirk-Willem van Gulik (Aug 26)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Carlos Alberto Lopez Perez (Aug 26)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) bodik (Aug 26)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) bodik (Aug 26)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Nikolay Kichukov (Aug 27)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Andrew Farmer (Aug 29)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Carlos Alberto Lopez Perez (Aug 26)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Dirk-Willem van Gulik (Aug 26)