It would be nice to mention in the title that Apache Web Server is affected. Apache has many products out there.
Apache vulnerable to easy DOS attack - workaround available
21–23 of 23 posts
Re: Apache vulnerable to easy DOS attack - workaround available
#22It would be nice to mention in the title that Apache Web Server is affected. Apache has many products out there.
Although pedantically correct, it is quite common for people to use thee term "Apache" to refer to the web server. The folder for settings is "/etc/apache2" on debian based distros for example.
Re: Apache vulnerable to easy DOS attack - workaround available
#23I created a little mini site that lets you check if your server is vulnerable, along with some information about the exploit: http://apache-range-exploit.com/
Just a quick note from the advisory site "When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module." Not sure if that's how you are checking for vulnerability, h…
I recently fixed an issue where the server wouldn't follow redirects which was causing some false negatives. If your site still shows as a no would you mind letting me know what the domain is so I can fix any other issue?
The way I check for the vulnerability is based on the original perl script in the OP link. I submit 20 byte range requests and check for a Partial string in the response, if I see that I assume that the server is vulnerable. It's more of an educated guess, but I've been using it myself to fix misc servers I have running.