Full Disclosure mailing list archives
Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192)
From: bodik <bodik () civ zcu cz>
Date: Fri, 26 Aug 2011 16:56:43 +0200
Dne 08/26/11 13:26, bodik napsal(a):
Option 2: (Pre 2.2 and 1.3) # Reject request when more than 5 ranges in the Range: header. # CVE-2011-3192 # RewriteEngine on RewriteCond %{HTTP:range} !(bytes=[^,]+(,[^,]+){0,4}$|^$) # RewriteCond %{HTTP:request-range} !(bytes=[^,]+(?:,[^,]+){0,4}$|^$) RewriteRule .* - [F]^^ Better use this: RewriteEngine on RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$) [NC,OR] RewriteCond %{HTTP:request-range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$) [NC] RewriteRule .* - [F]in any case, i found very wierd behavior on some of our webservers. as we applied the first version of workaround, something about 15% of our webpages seems to be broken, but the rest of virtual hosts were working fine.
because of messing with Options FollowSymLinks or SymLinksIfOwnerMatch and mod_rewrite i have to implement other workaround .. b _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Dirk-Willem van Gulik (Aug 25)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Anestis Bechtsoudis (Aug 26)
- <Possible follow-ups>
- Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Dirk-Willem van Gulik (Aug 26)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Carlos Alberto Lopez Perez (Aug 26)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) bodik (Aug 26)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) bodik (Aug 26)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Nikolay Kichukov (Aug 27)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Andrew Farmer (Aug 29)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Carlos Alberto Lopez Perez (Aug 26)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Dirk-Willem van Gulik (Aug 26)