You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Dirk-WIllem van Gulik <di...@webweaving.org> on 2011/08/24 15:07:52 UTC
Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (DRAFT-3)
* Folks - do we also need to add Request-Range ?
* Updated with Rudigers comments., Eric, Florians
* Consensus that the deflate stuff needs to go out reflected.
* More Comments please. Esp. on the quality and realisticness of the mitigtions.
* Is this the right list (and order) of the mitigations - or should ReWrite be first ?
* Timeline mentioning fine (we've never done that before) -- or best avoided ?
My plan is to wait for the US to fully wake up - and then call for a few quick +1's to get this out - ideally before 1600 zulu.
Thanks,
Dw.
Title: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2
Date: 20110824 1600Z
# Last Updated: 20110824 1600Z
Product: Apache Web Server
Versions: Apache 1.3 all versions, Apache 2 all versions
Description:
------------
A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by apache (http://seclists.org/fulldisclosure/2011/Aug/175). An attack tool is circulating in the wild. Active use of this tools has been observed.
The attack can be done remotely and with a modest number of requests leads to very significant memory and CPU usage.
The default apache installation is vulnerable.
There is currently no patch/new version of apache which fixes this vulnerability. This advisory will be updated when a long term fix is available. A fix is expected in the next 96 hours.
Mitigation:
------------
However are several immediate options to mitigate this issue until that time:
1) Use mod_headers to dis-allow the use of Range headers:
RequestHeader unset Range
Note that this may break certain clients - such as those used for
e-Readers and progressive/http-streaming video.
2) Use mod_rewrite to limit the number of ranges:
RewriteCond %{HTTP:range} !^bytes=[^,]+(,[^,]+){0,4}$
RewriteRule .* - [F]
3) Limit the size of the request field to a few hundred bytes. Note that while this
keeps the offending Range header short - it may break other headers; such as sizable
cookies or security fields.
LimitRequestFieldSize 200
Note that as the attack evolves in the field you are likely to have
to further limit this and/or impose other LimitRequestFields limits.
See: http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize
3) Deploy a Range header count module as a temporary stopgap measure:
http://people.apache.org/~dirkx/mod_rangecnt.c
5) Apply any of the current patches under discussion - such as:
http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.gmail.com%3e
Actions:
-----------
Apache HTTPD users are advised to investigate wether they are vulnerable (e.g. allow use of the Range header )and consider implementing any of the above mitigations immediately.
When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.
Planning:
-------------
This advisory will be updated when a fix/patch or new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 96 hours. Note that, while popular, Apache 1.3 is deprecated.
Re: VOTES please -- CVE-2011-3192: Range header DoS vulnerability in
Apache 1.3 and Apache 2 (Final-6)
Posted by Eric Covener <co...@gmail.com>.
see inline updates
On Wed, Aug 24, 2011 at 10:56 AM, Dirk-Willem van Gulik
<di...@webweaving.org> wrote:
> Various suggest on-list and off-list fixes applied. Thanks all.
>
> A few more +1's would be nice :)
>
> Dw.
>
>
>
>
>
> Title: CVE-2011-3192: Range header DoS vulnerability Apache HTTPD 1.3/2.x
> Apache HTTPD Security ADVISORY
>
> Date: 20110824 1600Z
> Product: Apache HTTPD Web Server
> Versions: Apache 1.3 all versions, Apache 2 all versions
>
> Description:
> ------------
>
> A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server:
>
> http://seclists.org/fulldisclosure/2011/Aug/175
>
> An attack tool is circulating in the wild. Active use of this tools has been observed.
>
> The attack can be done remotely and with a modest number of requests can cause very significant memory and CPU usage on the server.
>
> The default Apache HTTPD installation is vulnerable.
>
> There is currently no patch/new version of Apache HTTPD which fixes this vulnerability. This advisory will be updated when a long term fix is available.
>
> A full fix is expected in the next 48 hours.
>
> Mitigation:
> ------------
>
> However there are several immediate options to mitigate this issue until that time.
>
> 1) Use mod_rewrite to limit the number of ranges:
^ clarify due to directive addition
>
> Option 1:
> # drop Range header when more than 5 ranges.
> # CVE-2011-3192
> SetEnvIf Range (,.*?){5,} bad-range=1
> RequestHeader unset Range env=bad-range
>
> # optional logging.
> CustomLog logs/range-CVE-2011-3192.log common env=bad-range
>
> Option 2:
> # Reject request when more than 5 ranges in the Range: header.
> # CVE-2011-3192. Must be added to each VirtualHost and once
> # in the base configuration.
+RewriteEngine on
> RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
> RewriteRule .* - [F]
>
> The number 5 is arbitrary. Several 10's should not be an issue and may be
> required for sites which for example serve PDFs to very high end eReaders
> or use things such complex http based video streaming.
>
> 2) Limit the size of the request field to a few hundred bytes. Note that while this
> keeps the offending Range header short - it may break other headers; such as
> sizeable cookies or security fields.
>
> LimitRequestFieldSize 200
>
> Note that as the attack evolves in the field you are likely to have
> to further limit this and/or impose other LimitRequestFields limits.
>
> See: http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize
>
> 3) Use mod_headers to completely dis-allow the use of Range headers:
>
> RequestHeader unset Range
>
> Note that this may break certain clients - such as those used for
> e-Readers and progressive/http-streaming video.
>
> 4) Deploy a Range header count module as a temporary stopgap measure:
>
> http://people.apache.org/~dirkx/mod_rangecnt.c
>
> Precompiled binaries for some platforms are available at:
>
> http://people.apache.org/~dirkx/BINARIES.txt
>
> 5) Apply any of the current patches under discussion - such as:
>
> http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.gmail.com%3e
>
> Actions:
> -----------
> Apache HTTPD users who are concerned about a DoS attack against their server should consider implementing any of the above mitigations immediately.
>
> When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.
>
> Planning:
> -------------
> This advisory will be updated when new information, a patch or a new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 48 hours. Note that, while popular, Apache 1.3 is deprecated.
>
>
--
Eric Covener
covener@gmail.com
Re: VOTES please -- CVE-2011-3192: Range header DoS vulnerability in
Apache 1.3 and Apache 2 (Final-6)
Posted by Greg Ames <am...@gmail.com>.
On Wed, Aug 24, 2011 at 10:56 AM, Dirk-Willem van Gulik <
dirkx@webweaving.org> wrote:
+1 with Eric's edits. specifically,
>
> 1) Use mod_rewrite to limit the number of ranges:
>
Option 1 doesn't use mod_rewrite.
Option 1:
> # drop Range header when more than 5 ranges.
> # CVE-2011-3192
> SetEnvIf Range (,.*?){5,} bad-range=1
> RequestHeader unset Range env=bad-range
>
> # optional logging.
> CustomLog logs/range-CVE-2011-3192.log common env=bad-range
>
Greg
Re: VOTES please -- CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (Final-6)
Posted by Jim Jagielski <ji...@jaguNET.com>.
With the current fixes, +1
On Aug 24, 2011, at 10:56 AM, Dirk-Willem van Gulik wrote:
> Various suggest on-list and off-list fixes applied. Thanks all.
>
> A few more +1's would be nice :)
>
> Dw.
>
>
>
>
>
> Title: CVE-2011-3192: Range header DoS vulnerability Apache HTTPD 1.3/2.x
> Apache HTTPD Security ADVISORY
>
> Date: 20110824 1600Z
> Product: Apache HTTPD Web Server
> Versions: Apache 1.3 all versions, Apache 2 all versions
>
> Description:
> ------------
>
> A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server:
>
> http://seclists.org/fulldisclosure/2011/Aug/175
>
> An attack tool is circulating in the wild. Active use of this tools has been observed.
>
> The attack can be done remotely and with a modest number of requests can cause very significant memory and CPU usage on the server.
>
> The default Apache HTTPD installation is vulnerable.
>
> There is currently no patch/new version of Apache HTTPD which fixes this vulnerability. This advisory will be updated when a long term fix is available.
>
> A full fix is expected in the next 48 hours.
>
> Mitigation:
> ------------
>
> However there are several immediate options to mitigate this issue until that time.
>
> 1) Use mod_rewrite to limit the number of ranges:
>
> Option 1:
> # drop Range header when more than 5 ranges.
> # CVE-2011-3192
> SetEnvIf Range (,.*?){5,} bad-range=1
> RequestHeader unset Range env=bad-range
>
> # optional logging.
> CustomLog logs/range-CVE-2011-3192.log common env=bad-range
>
> Option 2:
> # Reject request when more than 5 ranges in the Range: header.
> # CVE-2011-3192
> #
> RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
> RewriteRule .* - [F]
>
> The number 5 is arbitrary. Several 10's should not be an issue and may be
> required for sites which for example serve PDFs to very high end eReaders
> or use things such complex http based video streaming.
>
> 2) Limit the size of the request field to a few hundred bytes. Note that while this
> keeps the offending Range header short - it may break other headers; such as
> sizeable cookies or security fields.
>
> LimitRequestFieldSize 200
>
> Note that as the attack evolves in the field you are likely to have
> to further limit this and/or impose other LimitRequestFields limits.
>
> See: http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize
>
> 3) Use mod_headers to completely dis-allow the use of Range headers:
>
> RequestHeader unset Range
>
> Note that this may break certain clients - such as those used for
> e-Readers and progressive/http-streaming video.
>
> 4) Deploy a Range header count module as a temporary stopgap measure:
>
> http://people.apache.org/~dirkx/mod_rangecnt.c
>
> Precompiled binaries for some platforms are available at:
>
> http://people.apache.org/~dirkx/BINARIES.txt
>
> 5) Apply any of the current patches under discussion - such as:
>
> http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.gmail.com%3e
>
> Actions:
> -----------
> Apache HTTPD users who are concerned about a DoS attack against their server should consider implementing any of the above mitigations immediately.
>
> When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.
>
> Planning:
> -------------
> This advisory will be updated when new information, a patch or a new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 48 hours. Note that, while popular, Apache 1.3 is deprecated.
>
Re: VOTES please -- CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (Final-6)
Posted by Dirk-Willem van Gulik <di...@webweaving.org>.
Various suggest on-list and off-list fixes applied. Thanks all.
A few more +1's would be nice :)
Dw.
Title: CVE-2011-3192: Range header DoS vulnerability Apache HTTPD 1.3/2.x
Apache HTTPD Security ADVISORY
Date: 20110824 1600Z
Product: Apache HTTPD Web Server
Versions: Apache 1.3 all versions, Apache 2 all versions
Description:
------------
A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server:
http://seclists.org/fulldisclosure/2011/Aug/175
An attack tool is circulating in the wild. Active use of this tools has been observed.
The attack can be done remotely and with a modest number of requests can cause very significant memory and CPU usage on the server.
The default Apache HTTPD installation is vulnerable.
There is currently no patch/new version of Apache HTTPD which fixes this vulnerability. This advisory will be updated when a long term fix is available.
A full fix is expected in the next 48 hours.
Mitigation:
------------
However there are several immediate options to mitigate this issue until that time.
1) Use mod_rewrite to limit the number of ranges:
Option 1:
# drop Range header when more than 5 ranges.
# CVE-2011-3192
SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range
# optional logging.
CustomLog logs/range-CVE-2011-3192.log common env=bad-range
Option 2:
# Reject request when more than 5 ranges in the Range: header.
# CVE-2011-3192
#
RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
RewriteRule .* - [F]
The number 5 is arbitrary. Several 10's should not be an issue and may be
required for sites which for example serve PDFs to very high end eReaders
or use things such complex http based video streaming.
2) Limit the size of the request field to a few hundred bytes. Note that while this
keeps the offending Range header short - it may break other headers; such as
sizeable cookies or security fields.
LimitRequestFieldSize 200
Note that as the attack evolves in the field you are likely to have
to further limit this and/or impose other LimitRequestFields limits.
See: http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize
3) Use mod_headers to completely dis-allow the use of Range headers:
RequestHeader unset Range
Note that this may break certain clients - such as those used for
e-Readers and progressive/http-streaming video.
4) Deploy a Range header count module as a temporary stopgap measure:
http://people.apache.org/~dirkx/mod_rangecnt.c
Precompiled binaries for some platforms are available at:
http://people.apache.org/~dirkx/BINARIES.txt
5) Apply any of the current patches under discussion - such as:
http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.gmail.com%3e
Actions:
-----------
Apache HTTPD users who are concerned about a DoS attack against their server should consider implementing any of the above mitigations immediately.
When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.
Planning:
-------------
This advisory will be updated when new information, a patch or a new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 48 hours. Note that, while popular, Apache 1.3 is deprecated.
Re: VOTES please -- CVE-2011-3192: Range header DoS vulnerability in
Apache 1.3 and Apache 2 (Final-5)
Posted by Eric Covener <co...@gmail.com>.
> CustomLog logs/range.log "%r %{Range}i" env=bad-range
>
Actually I was only using that to show/debug the result of the
directives, did not occur that folks would also want to log these!
Of course that makes sense though.
Unfortunately we lose the range header in the log when we zap it, so
logging it is not really so useful in concert with the conditional.
so probably just wise to collect them under common logformat:
SetEnvIf Range (,[^,]*){5,} bad-range=1
RequestHeader unset Range env=bad-range
CustomLog logs/range.log common env=bad-range
--
Eric Covener
covener@gmail.com
RE: VOTES please -- CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (Final-5)
Posted by "Plüm, Rüdiger, VF-Group" <ru...@vodafone.com>.
> -----Original Message-----
> From: Dirk-Willem van Gulik [mailto:dirkx@webweaving.org]
> Sent: Mittwoch, 24. August 2011 16:36
> To: dev@httpd.apache.org
> Subject: VOTES please -- CVE-2011-3192: Range header DoS
> vulnerability in Apache 1.3 and Apache 2 (Final-5)
>
> Folks,
>
> Can I have a few +1's on below - or feedback on what we'd
> like to have changed ?
>
> * Would like to get this out in an hour or so ?
>
> * FIne with the 48 hours commitment of an update ?
>
> Dw.
>
>
>
> Title: CVE-2011-3192: Range header DoS vulnerability
> Apache HTTPD 1.3/2.x
> Date: 20110824 1600Z
> Product: Apache HTTPD Web Server
> Versions: Apache 1.3 all versions, Apache 2 all versions
>
> Description:
> ------------
>
> A denial of service vulnerability has been found in the way
> the multiple overlapping ranges are handled by the Apache
> HTTPD server:
>
> http://seclists.org/fulldisclosure/2011/Aug/175
>
> An attack tool is circulating in the wild. Active use of this
> tools has been observed.
>
> The attack can be done remotely and with a modest number of
> requests can cause very significant memory and CPU usage on
> the server.
>
> The default Apache HTTPD installation is vulnerable.
>
> There is currently no patch/new version of Apache HTTPD which
> fixes this vulnerability. This advisory will be updated when
> a long term fix is available.
>
> A full fix is expected in the next 48 hours.
>
> Mitigation:
> ------------
>
> However there are several immediate options to mitigate this
> issue until that time:
>
> 1) Use mod_rewrite to limit the number of ranges:
>
> Option 1L
> RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
> RewriteRule .* - [F]
>
> Option 2:
> SetEnvIf Range (,.*?){5,} bad-range=1
> RequestHeader unset Range env=bad-range
> # optional logging.
> CustomLog logs/range.log "%r %{Range}i %{bad-range}e"
Shouldn't it be a conditional logging?
CustomLog logs/range.log "%r %{Range}i" env=bad-range
Otherwise looks good. +1.
Regards
Rüdiger
VOTES please -- CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (Final-5)
Posted by Dirk-Willem van Gulik <di...@webweaving.org>.
Folks,
Can I have a few +1's on below - or feedback on what we'd like to have changed ?
* Would like to get this out in an hour or so ?
* FIne with the 48 hours commitment of an update ?
Dw.
Title: CVE-2011-3192: Range header DoS vulnerability Apache HTTPD 1.3/2.x
Date: 20110824 1600Z
Product: Apache HTTPD Web Server
Versions: Apache 1.3 all versions, Apache 2 all versions
Description:
------------
A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server:
http://seclists.org/fulldisclosure/2011/Aug/175
An attack tool is circulating in the wild. Active use of this tools has been observed.
The attack can be done remotely and with a modest number of requests can cause very significant memory and CPU usage on the server.
The default Apache HTTPD installation is vulnerable.
There is currently no patch/new version of Apache HTTPD which fixes this vulnerability. This advisory will be updated when a long term fix is available.
A full fix is expected in the next 48 hours.
Mitigation:
------------
However there are several immediate options to mitigate this issue until that time:
1) Use mod_rewrite to limit the number of ranges:
Option 1L
RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
RewriteRule .* - [F]
Option 2:
SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range
# optional logging.
CustomLog logs/range.log "%r %{Range}i %{bad-range}e"
2) Limit the size of the request field to a few hundred bytes. Note that while this
keeps the offending Range header short - it may break other headers; such as
sizeable cookies or security fields.
LimitRequestFieldSize 200
Note that as the attack evolves in the field you are likely to have
to further limit this and/or impose other LimitRequestFields limits.
See: http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize
3) Use mod_headers to dis-allow the use of Range headers:
RequestHeader unset Range
Note that this may break certain clients - such as those used for
e-Readers and progressive/http-streaming video.
4) Deploy a Range header count module as a temporary stopgap measure:
http://people.apache.org/~dirkx/mod_rangecnt.c
5) Apply any of the current patches under discussion - such as:
http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.gmail.com%3e
Actions:
-----------
Apache HTTPD users who are concerned about a DoS attack against their server should consider implementing any of the above mitigations immediately.
When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.
Planning:
-------------
This advisory will be updated when a fix/patch or new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 48 hours. Note that, while popular, Apache 1.3 is deprecated.
Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and
Apache 2 (DRAFT-3)
Posted by Nick Kew <ni...@webthing.com>.
On Wed, 24 Aug 2011 09:30:34 -0400
Eric Covener <co...@gmail.com> wrote:
> Or more like Ruedigers:
>
> SetEnvIf Range (,[^,]*){5,} bad-range=1
Or just
Untaint HTTP_RANGE (,[^,]*){5,}
Is it time to re-suggest dropping mod_taint into trunk?
--
Nick Kew
Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and
Apache 2 (DRAFT-3)
Posted by Eric Covener <co...@gmail.com>.
On Wed, Aug 24, 2011 at 9:29 AM, Eric Covener <co...@gmail.com> wrote:
> On Wed, Aug 24, 2011 at 9:17 AM, Eric Covener <co...@gmail.com> wrote:
>>> * Is this the right list (and order) of the mitigations - or should ReWrite be first ?
>> FWIW I don't like rewrite first because it's so unruly with being
>> defined once per vhost + main server + RewriteEngine on.
>>
>> I like RequestHeader simplicity, and could be combined with SetEnvIf
>> to only zap long malicious looking headers.
>>
> e.g.
>
> SetEnvIf Range (,.*?){5,} bad-range=1
> RequestHeader unset Range env=bad-range
> CustomLog logs/range.log "%r %{Range}i %{bad-range}e"
>
> printf "GET / HTTP/1.1\r\nHost:
> localhost\r\nRange:bytes=0-1,2-3,4-5,5-6,7-9,10-12,11-99,44\r\n\r\n" |
> nc localhost 80
>
> GET / HTTP/1.1 - 1
>
> printf "GET / HTTP/1.1\r\nHost:
> localhost\r\nRange:bytes=0-1,2-3,4-5\r\n\r\n" | nc localhost 80
> GET / HTTP/1.1 bytes=0-1,2-3,4-5 -
>
Or more like Ruedigers:
SetEnvIf Range (,[^,]*){5,} bad-range=1
Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (DRAFT-3)
Posted by Jim Jagielski <ji...@jaguNET.com>.
+1
On Aug 24, 2011, at 10:29 AM, Plüm, Rüdiger, VF-Group wrote:
>
>
>> -----Original Message-----
>> From: Eric Covener [mailto:covener@gmail.com]
>> Sent: Mittwoch, 24. August 2011 15:29
>> To: dev@httpd.apache.org
>> Subject: Re: CVE-2011-3192: Range header DoS vulnerability in
>> Apache 1.3 and Apache 2 (DRAFT-3)
>>
>> On Wed, Aug 24, 2011 at 9:17 AM, Eric Covener
>> <co...@gmail.com> wrote:
>>>> * Is this the right list (and order) of the
>> mitigations - or should ReWrite be first ?
>>> FWIW I don't like rewrite first because it's so unruly with being
>>> defined once per vhost + main server + RewriteEngine on.
>>>
>>> I like RequestHeader simplicity, and could be combined with SetEnvIf
>>> to only zap long malicious looking headers.
>>>
>> e.g.
>>
>> SetEnvIf Range (,.*?){5,} bad-range=1
>> RequestHeader unset Range env=bad-range
>
> Nice one as well. Might be even better then the rewrite rule.
>
> Regards
>
> Rüdiger
>
RE: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (DRAFT-3)
Posted by "Plüm, Rüdiger, VF-Group" <ru...@vodafone.com>.
> -----Original Message-----
> From: Eric Covener [mailto:covener@gmail.com]
> Sent: Mittwoch, 24. August 2011 15:29
> To: dev@httpd.apache.org
> Subject: Re: CVE-2011-3192: Range header DoS vulnerability in
> Apache 1.3 and Apache 2 (DRAFT-3)
>
> On Wed, Aug 24, 2011 at 9:17 AM, Eric Covener
> <co...@gmail.com> wrote:
> >> * Is this the right list (and order) of the
> mitigations - or should ReWrite be first ?
> > FWIW I don't like rewrite first because it's so unruly with being
> > defined once per vhost + main server + RewriteEngine on.
> >
> > I like RequestHeader simplicity, and could be combined with SetEnvIf
> > to only zap long malicious looking headers.
> >
> e.g.
>
> SetEnvIf Range (,.*?){5,} bad-range=1
> RequestHeader unset Range env=bad-range
Nice one as well. Might be even better then the rewrite rule.
Regards
Rüdiger
Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and
Apache 2 (DRAFT-3)
Posted by Eric Covener <co...@gmail.com>.
On Wed, Aug 24, 2011 at 9:17 AM, Eric Covener <co...@gmail.com> wrote:
>> * Is this the right list (and order) of the mitigations - or should ReWrite be first ?
> FWIW I don't like rewrite first because it's so unruly with being
> defined once per vhost + main server + RewriteEngine on.
>
> I like RequestHeader simplicity, and could be combined with SetEnvIf
> to only zap long malicious looking headers.
>
e.g.
SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range
CustomLog logs/range.log "%r %{Range}i %{bad-range}e"
printf "GET / HTTP/1.1\r\nHost:
localhost\r\nRange:bytes=0-1,2-3,4-5,5-6,7-9,10-12,11-99,44\r\n\r\n" |
nc localhost 80
GET / HTTP/1.1 - 1
printf "GET / HTTP/1.1\r\nHost:
localhost\r\nRange:bytes=0-1,2-3,4-5\r\n\r\n" | nc localhost 80
GET / HTTP/1.1 bytes=0-1,2-3,4-5 -
--
Eric Covener
covener@gmail.com
Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and
Apache 2 (DRAFT-3)
Posted by Eric Covener <co...@gmail.com>.
> * Is this the right list (and order) of the mitigations - or should ReWrite be first ?
FWIW I don't like rewrite first because it's so unruly with being
defined once per vhost + main server + RewriteEngine on.
I like RequestHeader simplicity, and could be combined with SetEnvIf
to only zap long malicious looking headers.
RE: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (DRAFT-3)
Posted by "Plüm, Rüdiger, VF-Group" <ru...@vodafone.com>.
Reverse the order a litte bit:
2) , 3), 1) (as 1) is likely to break the most things compared to 2) and 3))
Regarding 2) see the ongoing discussion between Eric and me to find the correct expression.
Regards
Rüdiger
> -----Original Message-----
> From: Dirk-WIllem van Gulik
> Sent: Mittwoch, 24. August 2011 15:08
> To: Dirk-Willem van Gulik
> Cc: dev@httpd.apache.org; security@httpd.apache.org
> Subject: Re: CVE-2011-3192: Range header DoS vulnerability in
> Apache 1.3 and Apache 2 (DRAFT-3)
>
> * Folks - do we also need to add Request-Range ?
>
> * Updated with Rudigers comments., Eric, Florians
>
> * Consensus that the deflate stuff needs to go out reflected.
>
> * More Comments please. Esp. on the quality and
> realisticness of the mitigtions.
>
> * Is this the right list (and order) of the mitigations -
> or should ReWrite be first ?
>
> * Timeline mentioning fine (we've never done that before)
> -- or best avoided ?
>
> My plan is to wait for the US to fully wake up - and then
> call for a few quick +1's to get this out - ideally before 1600 zulu.
>
> Thanks,
>
> Dw.
>
>
>
>
>
>
>
> Title: CVE-2011-3192: Range header DoS
> vulnerability in Apache 1.3 and Apache 2
> Date: 20110824 1600Z
> # Last Updated: 20110824 1600Z
> Product: Apache Web Server
> Versions: Apache 1.3 all versions, Apache 2 all versions
>
> Description:
> ------------
>
> A denial of service vulnerability has been found in the way
> the multiple overlapping ranges are handled by apache
> (http://seclists.org/fulldisclosure/2011/Aug/175). An attack
> tool is circulating in the wild. Active use of this tools has
> been observed.
>
> The attack can be done remotely and with a modest number of
> requests leads to very significant memory and CPU usage.
>
> The default apache installation is vulnerable.
>
> There is currently no patch/new version of apache which fixes
> this vulnerability. This advisory will be updated when a long
> term fix is available. A fix is expected in the next 96 hours.
>
> Mitigation:
> ------------
>
> However are several immediate options to mitigate this issue
> until that time:
>
> 1) Use mod_headers to dis-allow the use of Range headers:
>
> RequestHeader unset Range
>
> Note that this may break certain clients - such as
> those used for
> e-Readers and progressive/http-streaming video.
>
> 2) Use mod_rewrite to limit the number of ranges:
>
> RewriteCond %{HTTP:range} !^bytes=[^,]+(,[^,]+){0,4}$
> RewriteRule .* - [F]
>
> 3) Limit the size of the request field to a few hundred
> bytes. Note that while this
> keeps the offending Range header short - it may break
> other headers; such as sizable
> cookies or security fields.
>
> LimitRequestFieldSize 200
>
> Note that as the attack evolves in the field you are
> likely to have
> to further limit this and/or impose other
> LimitRequestFields limits.
>
> See:
> http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize
>
> 3) Deploy a Range header count module as a temporary
> stopgap measure:
>
> http://people.apache.org/~dirkx/mod_rangecnt.c
>
> 5) Apply any of the current patches under discussion - such as:
>
>
> http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox
> /%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.g
> mail.com%3e
>
>
> Actions:
> -----------
> Apache HTTPD users are advised to investigate wether they are
> vulnerable (e.g. allow use of the Range header )and consider
> implementing any of the above mitigations immediately.
>
> When using a third party attack tool to verify vulnerability
> - know that most of the versions in the wild currently check
> for the presence of mod_deflate; and will (mis)report that
> your server is not vulnerable if this module is not present.
> This vulnerability is not dependent on presence or absence of
> that module.
>
> Planning:
> -------------
>
> This advisory will be updated when a fix/patch or new release
> is available. A patch or new apache release for Apache 2.0
> and 2.2 is expected in the next 96 hours. Note that, while
> popular, Apache 1.3 is deprecated.
>
>
>
>
>
>
>
>
Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (NEAR FINAL DRAFT-4)
Posted by Dirk-Willem van Gulik <di...@webweaving.org>.
On 24 Aug 2011, at 15:34, Guenter Knauf wrote:
> can you please apply:
> --- mod_rangecnt.c.orig Wed Aug 24 16:25:34 2011
> +++ mod_rangecnt.c Wed Aug 24 15:26:48 2011
Done.
> which I need on NetWare in order to get ap_hook_post_read_request() proto;
>
> and maybe we should also add links to mod_rangecnt binaries?
> for Netware:
> http://people.apache.org/~fuankg/httpd/apache_2.2.x-mod_rangecnt.zip
> http://people.apache.org/~fuankg/httpd/apache_2.0.x-mod_rangecnt.zip
Added pointers.
Dw.
Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and
Apache 2 (NEAR FINAL DRAFT-4)
Posted by Guenter Knauf <fu...@apache.org>.
Dirk,
Am 24.08.2011 15:23, schrieb Dirk-WIllem van Gulik:
> 4) Deploy a Range header count module as a temporary stopgap measure:
>
> http://people.apache.org/~dirkx/mod_rangecnt.c
can you please apply:
--- mod_rangecnt.c.orig Wed Aug 24 16:25:34 2011
+++ mod_rangecnt.c Wed Aug 24 15:26:48 2011
@@ -22,6 +22,7 @@
#include "httpd.h"
#include "http_config.h"
#include "http_log.h"
+#include "http_protocol.h"
#ifndef MAXRANGEHEADERS
#define MAXRANGEHEADERS (5)
which I need on NetWare in order to get ap_hook_post_read_request() proto;
and maybe we should also add links to mod_rangecnt binaries?
for Netware:
http://people.apache.org/~fuankg/httpd/apache_2.2.x-mod_rangecnt.zip
http://people.apache.org/~fuankg/httpd/apache_2.0.x-mod_rangecnt.zip
Gregg, are you up to provide Win32 binaries too?
Gün.
Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (NEAR FINAL DRAFT-4)
Posted by Dirk-WIllem van Gulik <di...@webweaving.org>.
On 24 Aug 2011, at 14:07, Dirk-WIllem van Gulik wrote:
* Folks - do we also need to add Request-Range ?
* Updated with Rudigers comments., Eric, Florians, Marks.
* Consensus that the deflate stuff needs to go out reflected.
* More Comments please. Esp. on the quality and realisticness of the mitigtions.
* Timeline mentioning fine (we've never done that before) -- or best avoided ?
My plan is to wait for the US to fully wake up - and then call around 1500Z for a few quick +1's to get this out - ideally before 1600 zulu.
Thanks,
Dw.
Title: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2
Date: 20110824 1600Z
# Last Updated: 20110824 1600Z
Product: Apache Web Server
Versions: Apache 1.3 all versions, Apache 2 all versions
Description:
------------
A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server (http://seclists.org/fulldisclosure/2011/Aug/175).
An attack tool is circulating in the wild. Active use of this tools has been observed.
The attack can be done remotely and with a modest number of requests leads to very significant memory and CPU usage.
The default Apache HTTPD installation is vulnerable.
There is currently no patch/new version of Apache HTTPD which fixes this vulnerability. This advisory will be updated when a long term fix is available. A full fix is expected in the next 48 hours.
Mitigation:
------------
However there are several immediate options to mitigate this issue until that time:
1) Use mod_headers to dis-allow the use of Range headers:
RequestHeader unset Range
Note that this may break certain clients - such as those used for
e-Readers and progressive/http-streaming video.
2) Use mod_rewrite to limit the number of ranges:
RewriteCond %{HTTP:range} !^bytes=[^,]+(,[^,]+){0,4}$
RewriteRule .* - [F]
3) Limit the size of the request field to a few hundred bytes. Note that while this
keeps the offending Range header short - it may break other headers; such as sizable
cookies or security fields.
LimitRequestFieldSize 200
Note that as the attack evolves in the field you are likely to have
to further limit this and/or impose other LimitRequestFields limits.
See: http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize
4) Deploy a Range header count module as a temporary stopgap measure:
http://people.apache.org/~dirkx/mod_rangecnt.c
5) Apply any of the current patches under discussion - such as:
http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.gmail.com%3e
Actions:
-----------
Apache HTTPD users who are concerned about a DoS attack against their server should consider implementing any of the above mitigations immediately.
When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.
Planning:
-------------
This advisory will be updated when a fix/patch or new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 48 hours. Note that, while popular, Apache 1.3 is deprecated.