You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2014/07/20 19:13:25 UTC
[Bug 56751] New: Fails to properly mitigate Slow Post DoS attack
https://issues.apache.org/bugzilla/show_bug.cgi?id=56751
Bug ID: 56751
Summary: Fails to properly mitigate Slow Post DoS attack
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: PC
OS: Linux
Status: NEW
Severity: major
Priority: P2
Component: mod_reqtimeout
Assignee: bugs@httpd.apache.org
Reporter: zmaximz@gmail.com
DETAILS:
The recommended/default mod_reqtimeout configuration allows a remote attacker
to consume all Apache connections while sending part of the post body in time
intervals (AKA SlowPost attack) with a byte-rate greater than the configured
MinRate (500 by default).
Example: Sending 10Kb of the body each 5 seconds will bypass recommended
configuration.
References to recommended conf:
1. http://publib.boulder.ibm.com/httpserv/manual60/mod/mod_reqtimeout.html
2. http://docs.cpanel.net/twiki/bin/view/EasyApache/Apache/SlowlorisAttacks
3.
http://blog.spiderlabs.com/2011/07/advanced-topic-of-the-week-mitigating-slow-http-dos-attacks.html#Mitigating
Slow Request Attacks with Mod_Reqtimeout and ModSecurity
IMPACT:
Vulnerable are most of the Apache users who rely on the mod_reqtimeout module
to mitigate the SlowPost DoS attack.
SOLUTION:
Add to the default configuration an upper bound (maxtimeout) for the "body"
parameter.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56751] Fails to properly mitigate Slow Post DoS attack
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56751
--- Comment #3 from Eric Covener <co...@gmail.com> ---
> I think editing the example might be the first step, so future
> mod_reqtimeout users won't be vulnerable.
Is what you're referring to as "the example" the text next to the word
"Default" in the manual? The default is not an example, it's what you get by
default when you don't use the directive. In other words, the compiled-in
defaults for the module. Is that what you're lobbying for to be 40 seconds?
As I said before, there are plenty of examples that use a timeout for the body.
But the user has to select one.
Please start a thread over on dev@httpd.apache.org if you want to discuss a
change to the defaults in the 2.4 or 2.2 maintenance stream -- I am personally
not in favor, but that is the proper place for discussion.
> Is there a common channel to inform all the distributions that ship with
> Apache httpd, so they could consider changing their default configuration?
Not really.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56751] Fails to properly mitigate Slow Post DoS attack
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56751
zmaximz@gmail.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |NEW
--- Comment #2 from zmaximz@gmail.com ---
As I understand from the module's behavior, "timeout" refers to "time to first
byte" of the header/body and "maxtimeout" refers to "time to last byte" of the
header/body.
"type=timeout-maxtimeout,MinRate=data_rate"
What I believe that is missing is the "maxtimeout" for the body:
RequestReadTimeout header=20-40,MinRate=500 body=20-40,MinRate=500
Instead of:
RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
The missing "maxtimeout" for the body makes the described attack effective.
I believe 40 seconds is a reasonable time for "maxtimeout".
I think editing the example might be the first step, so future mod_reqtimeout
users won't be vulnerable.
Is there a common channel to inform all the distributions that ship with Apache
httpd, so they could consider changing their default configuration?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56751] Fails to properly mitigate Slow Post DoS attack
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56751
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #1 from Eric Covener <co...@gmail.com> ---
http://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html
The first and fourth examples in the manual use a maxtimeout on the body (if
I'm understanding the syntax correctly).
Net, if you want a maxtimeout, you have to configure one.
Is it the manual you want updated?
Or some default configuration?
Or the way the module behaves if you load it and don't configure it at all?
Do you have an argument for a reasonable (doesn't break normal clients) and
effective (actual benefit to a client that reconnects) body maxtimeout?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org