Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apache vulnerable to easy DOS attack - workaround available

mail-archives.apache.org

Post reply on HN
Print view View original

1–10 of 23 posts

Re: Apache vulnerable to easy DOS attack - workaround available

#2

Post by ck2 »

Of all the workarounds, this is probably the best option because it will still allow ranges to function.

  Option 1: (Apache 2.0 and 2.2)

          # Drop the Range header when more than 5 ranges.
          # CVE-2011-3192
          SetEnvIf Range (,.*?){5,} bad-range=1
          RequestHeader unset Range env=bad-range

          # optional logging.
          CustomLog logs/range-CVE-2011-3192.log common env=bad-range

  Option 2: (Also for Apache 1.3)

          # Reject request when more than 5 ranges in the Range: header.
          # CVE-2011-3192
          #
          RewriteEngine on
          RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
          RewriteRule .* - [F]

Re: Apache vulnerable to easy DOS attack - workaround available

#3

Post by jarin »

ck2 wrote: post #2

Of all the workarounds, this is probably the best option because it will still allow ranges to function. Option 1: (Apache 2.0 and 2.2) # Drop the Range header when more than 5 ranges. # CVE-2011-3192 SetEnvIf Range (,.*?){5,} bad-range=1 RequestHeader unset Range env=bad-range # optional logging. CustomLog logs/range-CVE-2011-3192.log common env=bad-range Option 2: (Also for Apache 1.3) # Reject request when more th…

Making sure ranges work is especially important if you're serving up streaming video.

Re: Apache vulnerable to easy DOS attack - workaround available

#5

Post by kevingadd »

aw3c2 wrote: post #4

I would have never thought one could request multiple ranges in the first place. How does that work (multiple connections?) and of what use it is?

One hypothetical use would be for dealing with formats that have both headers and footers: For example, an MP3 will have a frame header at the start of every frame, so you'd want the beginning of the file to get that header. But you'd also want the last few KB of the MP3, because ID3 tags go there.

Re: Apache vulnerable to easy DOS attack - workaround available

#6

Post by chalst »

For sites that don't serve large files, option #4, disabling the range header, is the simplest option.

Note that this means that downloads are not resumable, which can easily annoy site users even if there is no multimedia involved. You only need to specify one range in the header in this case, but to do that you need option #1.

Re: Apache vulnerable to easy DOS attack - workaround available

#7

Post by ck2 »

jarin wrote: post #3
ck2 wrote: post #2

Of all the workarounds, this is probably the best option because it will still allow ranges to function. Option 1: (Apache 2.0 and 2.2) # Drop the Range header when more than 5 ranges. # CVE-2011-3192 SetEnvIf Range (,.*?){5,} bad-range=1 RequestHeader unset Range env=bad-range # optional logging. CustomLog logs/range-CVE-2011-3192.log common env=bad-range Option 2: (Also for Apache 1.3) # Reject request when more th…

Making sure ranges work is especially important if you're serving up streaming video.

Also for download resuming if I remember correctly.

Re: Apache vulnerable to easy DOS attack - workaround available

#8

Post by ck2 »

chalst wrote: post #6

For sites that don't serve large files, option #4, disabling the range header, is the simplest option. Note that this means that downloads are not resumable, which can easily annoy site users even if there is no multimedia involved. You only need to specify one range in the header in this case, but to do that you need option #1.

I guess you could just allow ONE range which seems like a good compromise and defeat the attack?

     RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,1}$|^$)
     RewriteRule .* - [F]
(for those that don't speak regex: the 0,1 allows either one or none range headers to be accepted, more or less will fail to be served anything)

That will allow downloads to still resume and it works in any version of apache.

Re: Apache vulnerable to easy DOS attack - workaround available

#10

Post by pielud »

aw3c2 wrote: post #4

I would have never thought one could request multiple ranges in the first place. How does that work (multiple connections?) and of what use it is?

You make a request for several ranges of a file using the range header, something like:

Range: bytes=100-200, 600-800, 1500-

If the server supports ranges, it will respond with a 206 Partial Content status, and send a multipart/byteranges response body, which looks like this http://www.freesoft.org/CIE/RFC/2068/225.htm. Basically a delimited string containing all the ranges.

This is useful for some streaming audio/video formats and especially for large pdfs. IIRC, pdfs typically have header information at the end of the file, so it's useful for a pdf reader to get the end of the file first.

Post reply on HN