lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <4E57B42B.2000300@civ.zcu.cz> Date: Fri, 26 Aug 2011 16:56:43 +0200 From: bodik <bodik@....zcu.cz> To: full-disclosure@...ts.grok.org.uk Subject: Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Dne 08/26/11 13:26, bodik napsal(a): > >>> Option 2: (Pre 2.2 and 1.3) >>> >>> # Reject request when more than 5 ranges in the Range: header. # >>> CVE-2011-3192 # RewriteEngine on RewriteCond %{HTTP:range} >>> !(bytes=[^,]+(,[^,]+){0,4}$|^$) # RewriteCond %{HTTP:request-range} >>> !(bytes=[^,]+(?:,[^,]+){0,4}$|^$) RewriteRule .* - [F] >> ^^ Better use this: >> >> RewriteEngine on RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$) >> [NC,OR] RewriteCond %{HTTP:request-range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$) >> [NC] RewriteRule .* - [F] >> > > in any case, i found very wierd behavior on some of our webservers. as we > applied the first version of workaround, something about 15% of our webpages > seems to be broken, but the rest of virtual hosts were working fine. because of messing with Options FollowSymLinks or SymLinksIfOwnerMatch and mod_rewrite i have to implement other workaround .. b _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists