You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2013/01/28 23:23:00 UTC
[Bug 54498] New: apache crash on any cgi request with certain http
accept header
https://issues.apache.org/bugzilla/show_bug.cgi?id=54498
Bug ID: 54498
Summary: apache crash on any cgi request with certain http
accept header
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: PC
OS: Windows XP
Status: NEW
Severity: normal
Priority: P2
Component: All
Assignee: bugs@httpd.apache.org
Reporter: franktraffic@gmail.com
Classification: Unclassified
I have problem with regular crash my apache / whole server because of out of
memory.
After investigating I found somebody sends requests to any .cgi script with
this header [HTTP_ACCEPT] => !!mUiX6BaBHCeqIoxmNSdGa/XC2O8YisRs3w03aglTIw0A
I have only certain group of scripts installed, but i think it will crash with
any script.
As a result it generates thousand httpd proccesses and it eat all resourses.
In log
212.117.160.93 - - [08/Jan/2013:17:41:19 -0600] GET /cgi-bin/a2/out.cgi
HTTP/1.1 "200" 56695613 "http://cut.../cgi-b
in/a2/out.cgi" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" "-"
This is 56695613 answer size. It looks like while it return this answer all
scripts are locked and because new requests are incoming - in couple of minutes
there are accumulated thousand httpd proccesses.
I verified and simulated it - it crashes apache every time when I send this
headers. It works on Freebsd server. I tried send this request to other OS - it
doesnt crash.
Before I found this problem I tried reinstall OS from freebsd 8 to freebsd 9. I
also tried all versions of Apache, including last one, and all mysql, php,
nginx.
Could you fix this please. This person changes ip and I need catch his ip and
add to blacklist. But time of time my server crashes.
Thanks
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 54498] apache crash on any cgi request with certain http accept
header
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=54498
--- Comment #1 from Frank <fr...@gmail.com> ---
rdtfgyuhijkl;'
wertyui
any one read this and going to fix??
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 54498] apache crash on any cgi request with certain http accept
header
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=54498
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #2 from Eric Covener <co...@gmail.com> ---
You'll need to provide some more detail if anyone is going to have a serious
look. The detail you provided didn't have any effect on a sample CGI on Linux,
AIX, or Solaris.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 54498] apache crash on any cgi request with certain http accept
header
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=54498
--- Comment #5 from Eric Covener <co...@gmail.com> ---
Can you get a backtrace of the CGI and httpd processes? It would be best if
you reproduced with a simple "hello world" CGI. Also details of your version
and configuration.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 54498] apache crash on any cgi request with certain http accept
header
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=54498
Frank <fr...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |NEW
--- Comment #4 from Frank <fr...@gmail.com> ---
(In reply to comment #2)
> You'll need to provide some more detail if anyone is going to have a serious
> look. The detail you provided didn't have any effect on a sample CGI on
> Linux, AIX, or Solaris.
Please specify what info can I provide more? I have attached screenshot.
I send simple request with this tool http://soft-net.net/send-http-tool/
This 276 processes are generated after 5 seconds. It will be 1,5k+ in minute
and server will be out of memory if not restart apache.
This happens on FreeBsd server. I have reinstalled it from clean and it happens
again.
I am interested this to be fixed, because somebody disturb my server with this.
Please try it. Or should I make script and crash all freebsd servers for make
you interesting.
Thanks.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 54498] apache crash on any cgi request with certain http accept
header
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=54498
--- Comment #3 from Frank <fr...@gmail.com> ---
Created attachment 29957
--> https://issues.apache.org/bugzilla/attachment.cgi?id=29957&action=edit
this show what happen
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org