Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (NEAR FINAL DRAFT-4)

[Dirk-WIllem van Gulik <di...@webweaving.org>]

On 24 Aug 2011, at 14:07, Dirk-WIllem van Gulik wrote:

*	Folks - do we also need to add Request-Range ?

*	Updated with Rudigers comments., Eric, Florians, Marks.

*	Consensus that the deflate stuff needs to go out reflected.

*	More Comments please. Esp. on the quality and realisticness of the mitigtions.

*	Timeline mentioning fine (we've never done that before) -- or best avoided ?

My plan is to wait for the US to fully wake up - and then call around 1500Z for a few quick +1's to get this out - ideally before 1600 zulu.

Thanks,

Dw.







Title:	    CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2
Date:       20110824 1600Z
# Last Updated:  20110824 1600Z
Product:   Apache Web Server
Versions:  Apache 1.3 all versions, Apache 2 all versions

Description:
------------

A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server (http://seclists.org/fulldisclosure/2011/Aug/175).  

An attack tool is circulating in the wild. Active use of this tools has been observed.

The attack can be done remotely and with a modest number of requests leads to very significant memory and CPU usage. 

The default Apache HTTPD installation is vulnerable.

There is currently no patch/new version of Apache HTTPD which fixes this vulnerability. This advisory will be updated when a long term fix is available. A full fix is expected in the next 48 hours. 

Mitigation:
------------

However there are several immediate options to mitigate this issue until that time:

1)	Use mod_headers to dis-allow the use of Range headers:

		RequestHeader unset Range 

	Note that this may break certain clients - such as those used for
	e-Readers and progressive/http-streaming video.

2)	Use mod_rewrite to limit the number of ranges:

		RewriteCond %{HTTP:range} !^bytes=[^,]+(,[^,]+){0,4}$
		RewriteRule .* - [F]

3)	Limit the size of the request field to a few hundred bytes. Note that while this
	keeps the offending Range header short - it may break other headers; such as sizable
	cookies or security fields. 

		LimitRequestFieldSize 200

	Note that as the attack evolves in the field you are likely to have
	to further limit this and/or impose other LimitRequestFields limits.

	See: 	http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize

4)	Deploy a Range header count module as a temporary stopgap measure:

	http://people.apache.org/~dirkx/mod_rangecnt.c

5)	Apply any of the current patches under discussion - such as:

	http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.gmail.com%3e


Actions:
-----------
Apache HTTPD users who are concerned about a DoS attack against their server should consider implementing any of the above mitigations immediately. 

When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.

Planning:
-------------

This advisory will be updated when a fix/patch or new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 48 hours. Note that, while popular, Apache 1.3 is deprecated. 

Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (NEAR FINAL DRAFT-4)

[Dirk-Willem van Gulik <di...@webweaving.org>]

On 24 Aug 2011, at 15:34, Guenter Knauf wrote:

> can you please apply:
> --- mod_rangecnt.c.orig	Wed Aug 24 16:25:34 2011
> +++ mod_rangecnt.c	Wed Aug 24 15:26:48 2011

Done.

> which I need on NetWare in order to get ap_hook_post_read_request() proto;
> 
> and maybe we should also add links to mod_rangecnt binaries?
> for Netware:
> http://people.apache.org/~fuankg/httpd/apache_2.2.x-mod_rangecnt.zip
> http://people.apache.org/~fuankg/httpd/apache_2.0.x-mod_rangecnt.zip


Added pointers.

Dw.

Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (NEAR FINAL DRAFT-4)

[Guenter Knauf <fu...@apache.org>]

Dirk,
Am 24.08.2011 15:23, schrieb Dirk-WIllem van Gulik:
> 4)	Deploy a Range header count module as a temporary stopgap measure:
>
> 	http://people.apache.org/~dirkx/mod_rangecnt.c
can you please apply:
--- mod_rangecnt.c.orig	Wed Aug 24 16:25:34 2011
+++ mod_rangecnt.c	Wed Aug 24 15:26:48 2011
@@ -22,6 +22,7 @@
  #include "httpd.h"
  #include "http_config.h"
  #include "http_log.h"
+#include "http_protocol.h"

  #ifndef MAXRANGEHEADERS
  #define MAXRANGEHEADERS (5)

which I need on NetWare in order to get ap_hook_post_read_request() proto;

and maybe we should also add links to mod_rangecnt binaries?
for Netware:
http://people.apache.org/~fuankg/httpd/apache_2.2.x-mod_rangecnt.zip
http://people.apache.org/~fuankg/httpd/apache_2.0.x-mod_rangecnt.zip

Gregg, are you up to provide Win32 binaries too?

Gün.