Apache Killer

Apache released 2.2.20 which fixes CVE-2011-3192:

 

 

http://www.apache.org/dist/httpd/Announcement2.2.html

 

 

Aaron

I'll send a tshirt to the first non-MVP or F5er with a solution using something other than regex.

Jason,

Not sure if you're monitoring this, but the following seems like a solution without using regex:

when HTTP_REQUEST {
    if { [HTTP::header exists "Range"] } {
    set tot_ranges [llength [split [HTTP::header "Range"], ","]]
    if { $tot_ranges >= 40 } {
    log local0. " Range attack CVE-2011-3192 detected from [IP::client_addr] on Host [HTTP::host].  [llength [split [HTTP::header "Range"], ","]] ranges requested."
        HTTP::header remove Range
        drop
        }
        return
    }
}
 

Seems to provide the same results on my LTM VE. Not sure what the performance benefit looks like.

James Denton

james.denton@rackspace.com

wow, missed this. Yep, that'll play, James. Congrats! We'll get a t-shirt on the way to you. Is the address in your profile correct?