full-disclosure - Re: Apache Killer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 25 Aug 2011 18:57:44 +0200
From: Marco Ermini <marco.ermini@...il.com>
To: Full-Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Apache Killer

On 24 August 2011 16:23, ZOne wrote:
> For those using Snort, a local snort rule to alert for incoming attacks
> might help while waiting for a patch.
>
> example:
>
> alert tcp $EXTERNAL_NET any -> any 80 (msg:"INBOUND Apache Killer script:
> Local web server is under attack."; content:"Range:bytes=0-"; classtype:
> denial-of-service; threshold: type threshold, track by_src, count 5 ,
> seconds 20; sid:3000005;)

For those using Snort, you should take care that this rule is very
easy to break: it just detects a string "Range:bytes=0-" inside of TCP
packets sent to port 80, sent five times in twenty second by the same
IP.

That is very easy to avoid, just using a different initial byte than
zero, putting a space between "Range:" and "bytes", or changing the
threshold. Basically it is violating rule 1 of IDS signature writing,
"patch the vulnerability, not the exploit" - as just changing the
exploit as little as a single space will not make it work.

I did instead the following:

alert tcp any any -> any $HTTP_PORTS ( \
content: "Range"; nocase; http_header; \
pcre:"/(\d\,){6,}/xH"; http_header; \
msg:"Apache DOS http://seclists.org/fulldisclosure/2011/Aug/175"; \
reference:cve,2011-3192 )

However this is certainly not the best possible as I am no Snort rules
guru. Also I have not tested it.
Another one possibly faster, can be something like the following
(again I have not tested it):

pcre: "/^Range:bytes\s+\d+-\d?,\d+-\d+,\d+-\d+,\d+-\d+,\d+-\d+,\d+-\d+,/xH";
http_header; \

Cheers
-- 
Marco Ermini
root@...an # mount -t life -o ro /dev/dna /genetic/research
http://www.linkedin.com/in/marcoermini
"Jesus saves... but Buddha makes incremental back-ups!"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/