You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2011/08/24 02:49:57 UTC
DO NOT REPLY [Bug 51714] New: Byte Range Filter might consume huge
amounts of memory combined with compressed streams
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
Bug #: 51714
Summary: Byte Range Filter might consume huge amounts of memory
combined with compressed streams
Product: Apache httpd-2
Version: 2.2.17
Platform: All
OS/Version: All
Status: NEW
Severity: critical
Priority: P2
Component: All
AssignedTo: bugs@httpd.apache.org
ReportedBy: isowarez.isowarez.isowarez@googlemail.com
Classification: Unclassified
Created attachment 27429
--> https://issues.apache.org/bugzilla/attachment.cgi?id=27429
DoS Exploit for mentioned vulnerability
At least apache 2.2.17 has a remotely exploitable dos vulnerability which
allows to consume all memory on a target system. A request for triggering the
memory consumption includes a large "Range" header which requests as many
different bytes as possible from a file served by httpd. Combining this with a
gzip "Accept-Encoding" header the httpd is assumed to compress each of the
bytes requested in the Range header seperately consuming large memory regions.
The behaviour when compressing the streams is devestating and can end up in
rendering the underlying operating system unusable when the requests are sent
parallely. Symptomps are swapping to disk and killing of processes including
but not solely httpd processes.
How to repeat:
Execute the attached perl script for a vulnerable httpd, means Byte Range
filter and mod_deflate/mod_gzip enabled.
Sidenote:
Apache should be aware of that through posting to full disclosure. Nevertheless
should in my opinion this bug be resolved.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 51714] Byte Range Filter might consume huge
amounts of memory combined with compressed streams
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
--- Comment #2 from Mikko Parviainen <mi...@gmail.com> 2011-08-26 10:13:11 UTC ---
First, I'm not an expert on the matter. A small addition might be in place to
the work-around option suggested in:
<http://marc.info/?l=apache-httpd-dev&m=131418828705324&w=2>
The first mitigation option was a configuration change:
RequestHeader unset Range
In addition to dropping the "Range" from request headers, it might prove useful
to drop the "If-Range" as well, and might also be polite to respond with
"Accept-Ranges: none". This could be accomplished with:
# Removes the "Range" and "If-Range" from the request headers
RequestHeader unset Range
RequestHeader unset If-Range
# Removes all "Accept-Ranges" from the response headers
Header unset Accept-Ranges
# Sets "Accept-Ranges: none" to the response headers
Header set Accept-Ranges none
(I'm not sure if the "Header unset Accept-Ranges" is even necessary.)
According to the HTTP 1.1 specification RFC 2616:
* "Servers that do not accept any kind of range request for a resource MAY send
'Accept-Ranges: none'" (section 14.5); and
* "A server MAY ignore the Range header" (section 14.35.2).
But clearly this is only a work-around.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 51714] Byte Range Filter might consume huge
amounts of memory combined with compressed streams
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
--- Comment #4 from akuster <li...@kama-aina.net> 2011-09-13 17:24:15 UTC ---
(In reply to comment #3)
> released in 2.2.20, just needs a 2.0 release to close I guess.
any news on a 2.0.x fix ?
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 51714] Byte Range Filter might consume huge amounts of memory
combined with compressed streams
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
chutiantian <ch...@126.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS|All |HP-UX
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 51714] Byte Range Filter might consume huge
amounts of memory combined with compressed streams
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
Christopher Head <ch...@hotmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC|chris2k01@hotmail.com |
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 51714] Byte Range Filter might consume huge
amounts of memory combined with compressed streams
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
Christopher Head <ch...@hotmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |chris2k01@hotmail.com
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 51714] Byte Range Filter might consume huge
amounts of memory combined with compressed streams
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
--- Comment #1 from kingcope <is...@googlemail.com> 2011-08-24 03:32:01 UTC ---
As discussed on the Apache Dev Mailing list it looks like this issue has
nothing to do with mod_deflate or mod_gzip, wrong assumption by me.
(In reply to comment #0)
> Created attachment 27429 [details]
> DoS Exploit for mentioned vulnerability
>
> At least apache 2.2.17 has a remotely exploitable dos vulnerability which
> allows to consume all memory on a target system. A request for triggering the
> memory consumption includes a large "Range" header which requests as many
> different bytes as possible from a file served by httpd. Combining this with a
> gzip "Accept-Encoding" header the httpd is assumed to compress each of the
> bytes requested in the Range header seperately consuming large memory regions.
> The behaviour when compressing the streams is devestating and can end up in
> rendering the underlying operating system unusable when the requests are sent
> parallely. Symptomps are swapping to disk and killing of processes including
> but not solely httpd processes.
>
> How to repeat:
> Execute the attached perl script for a vulnerable httpd, means Byte Range
> filter and mod_deflate/mod_gzip enabled.
>
> Sidenote:
> Apache should be aware of that through posting to full disclosure. Nevertheless
> should in my opinion this bug be resolved.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 51714] Byte Range Filter might consume huge
amounts of memory combined with compressed streams
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
nada <ap...@valgronda.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |apache_bugzilla@valgronda.c
| |om
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 51714] Byte Range Filter might consume huge
amounts of memory combined with compressed streams
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |FixedInTrunk
--- Comment #3 from Eric Covener <co...@gmail.com> 2011-09-03 17:58:08 UTC ---
released in 2.2.20, just needs a 2.0 release to close I guess.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 51714] Byte Range Filter might consume huge amounts of memory
combined with compressed streams
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS|HP-UX |All
--- Comment #5 from Eric Covener <co...@gmail.com> ---
revert OS change.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 51714] Byte Range Filter might consume huge
amounts of memory combined with compressed streams
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
S. Morris Rose <st...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |stinkoid@gmail.com
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 51714] Byte Range Filter might consume huge amounts of memory
combined with compressed streams
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org