ArchiveOrangemail archive

dev.httpd.apache.org


(List home) (Recent threads) (11 other Apache HTTPD lists)

Subscription Options

  • RSS or Atom: Read-only subscription using a browser or aggregator. This is the recommended way if you don't need to send messages to the list. You can learn more about feed syndication and clients here.
  • Conventional: All messages are delivered to your mail address, and you can reply. To subscribe, send an email to the list's subscribe address with "subscribe" in the subject line, or visit the list's homepage here.
  • Moderate traffic list: up to 30 messages per day
  • This list contains about 134,950 messages, beginning Feb 1995
  • 14 messages added yesterday
Report the Spam
This button sends a spam report to the moderator. Please use it sparingly. For other removal requests, read this.
Are you sure? yes no

CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2 (DRAFT)dev

Ad
Dirk-Willem van Gulik 1314187929Wed, 24 Aug 2011 12:12:09 +0000 (UTC)
Comments please. Esp. on the quality and realisticness of the mitigtions.


Title:	    CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2
Date:       20110824 1600Z
# Last Updated:  20110824 1600Z
Product:   Apache Web Server
Versions:  Apache 1.3 all versions, Apache 2 all versions

Description:
------------

A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by apache (http://seclists.org/fulldisclosure/2011/Aug/1...). It most commonly manifests itself when static content is made available with compression on the fly through mod_deflate. 

This is a very common (the default right!?) configuration. 

The attack can be done remotely and with a modest number of requests leads to very significant memory and CPU usage. 

Active use of this tools has been observed in the wild.

There is currently no patch/new version of apache which fixes this vulnerability. This advisory will be updated when a long term fix is available. A fix is expected in the next 96 hours. 

Mitigation:
------------

However are several immediate options to mitigate this issue until that time:

1)	Disable compression-on-the-fly by:

	1)	removing mod_deflate as a loaded module and/or by removing any 
		AddOutputFilterByType/SetOutputFilter DEFLATE entries.

	2) 	Disable it with "BrowserMatch .* no-gzip"

	See: 	http://httpd.apache.org/docs/2.0/mod/mod_defl...
		http://httpd.apache.org/docs/2.2/mod/mod_defl...

2)	Use mod_headers to dis-allow the use of Range headers:

		RequestHeader unset Range 

	Note that this may break certain clients - such as those used for
	e-Readers and progressive/http-streaming video.

2)	Limit the size of the request field to a few hundred bytes. Note that while this
	keeps the offending Range header short - it may break other headers; such as sizable
	cookies or security fields. 

		LimitRequestFieldSize 200

	Note that as the attack evolves in the field you are likely to have
	to further limit this and/or impose other LimitRequestFields limits.

	See: 	http://httpd.apache.org/docs/2.2/mod/core.htm...

3)	Deploy a Range header count module as a temporary stopgap measure:

	http://people.apache.org/~dirkx/mod_rangecnt....

4)	Apply any of the current patches under discussion - such as:

	http://mail-archives.apache.org/mod_mbox/http...

Actions:
--------
Apache HTTPD users are advised to investigate wether they are vulnerable (e.g. allow Range headers and use mod_deflate) and consider implementing any of the above mitigations. 

Planning:
--------

This advisory will be updated when a fix/patch or new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 96 hours. Note that, while popular, Apache 1.3 is deprecated.
Dirk-Willem van Gulik 1314188285Wed, 24 Aug 2011 12:18:05 +0000 (UTC)
*	Updated with Rudigers comments. 

*	Do we have consensus that the deflate stuff needs to go out - is not relevant ?

*	More Comments please. Esp. on the quality and realisticness of the mitigtions.

Thanks,

Title:	    CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2
Date:       20110824 1600Z
# Last Updated:  20110824 1600Z
Product:   Apache Web Server
Versions:  Apache 1.3 all versions, Apache 2 all versions

Description:
------------

A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by apache (http://seclists.org/fulldisclosure/2011/Aug/1...). It most commonly manifests itself when static content is made available with compression on the fly through mod_deflate - but other modules which buffer and/or generate content in-memory are likely to be affected as well. 

This is a very common (the default right!?) configuration. 

The attack can be done remotely and with a modest number of requests leads to very significant memory and CPU usage. 

Active use of this tools has been observed in the wild.

There is currently no patch/new version of apache which fixes this vulnerability. This advisory will be updated when a long term fix is available. A fix is expected in the next 96 hours. 

Mitigation:
------------

However are several immediate options to mitigate this issue until that time:

1)	Use mod_headers to dis-allow the use of Range headers:

		RequestHeader unset Range 

	Note that this may break certain clients - such as those used for
	e-Readers and progressive/http-streaming video.

2)	Use mod_rewrite to limit the number of ranges:

		RewriteCond %{HTTP:range} ^bytes=[^,]+(,[^,]+){0,4}$
		RewriteRule .* - [F]

3)	Limit the size of the request field to a few hundred bytes. Note that while this
	keeps the offending Range header short - it may break other headers; such as sizable
	cookies or security fields. 

		LimitRequestFieldSize 200

	Note that as the attack evolves in the field you are likely to have
	to further limit this and/or impose other LimitRequestFields limits.

	See: 	http://httpd.apache.org/docs/2.2/mod/core.htm...

3)	Deploy a Range header count module as a temporary stopgap measure:

	http://people.apache.org/~dirkx/mod_rangecnt....

4)	If your server (only) server static content then disable compression-on-the-fly by:

	1)	removing mod_deflate as a loaded module and/or by removing any 
		AddOutputFilterByType/SetOutputFilter DEFLATE entries.

	2) 	Disable it with "BrowserMatch .* no-gzip"

	See: 	http://httpd.apache.org/docs/2.0/mod/mod_defl...
		http://httpd.apache.org/docs/2.2/mod/mod_defl...

5)	Apply any of the current patches under discussion - such as:

	http://mail-archives.apache.org/mod_mbox/http...

Actions:
--------
Apache HTTPD users are advised to investigate wether they are vulnerable (e.g. allow Range headers and use mod_deflate) and consider implementing any of the above mitigations. 

Planning:
--------

This advisory will be updated when a fix/patch or new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 96 hours. Note that, while popular, Apache 1.3 is deprecated.
Dirk-WIllem van Gulik 1314191304Wed, 24 Aug 2011 13:08:24 +0000 (UTC)
*	Folks - do we also need to add Request-Range ?

*	Updated with Rudigers comments., Eric, Florians

*	Consensus that the deflate stuff needs to go out reflected.

*	More Comments please. Esp. on the quality and realisticness of the mitigtions.

*	Is this the right list (and order) of the mitigations - or should ReWrite be first ?

*	Timeline mentioning fine (we've never done that before) -- or best avoided ?

My plan is to wait for the US to fully wake up - and then call for a few quick +1's to get this out - ideally before 1600 zulu.

Thanks,

Dw.







Title:	    CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2
Date:       20110824 1600Z
# Last Updated:  20110824 1600Z
Product:   Apache Web Server
Versions:  Apache 1.3 all versions, Apache 2 all versions

Description:
------------

A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by apache (http://seclists.org/fulldisclosure/2011/Aug/1...).  An attack tool is circulating in the wild. Active use of this tools has been observed.

The attack can be done remotely and with a modest number of requests leads to very significant memory and CPU usage. 

The default apache installation is vulnerable.

There is currently no patch/new version of apache which fixes this vulnerability. This advisory will be updated when a long term fix is available. A fix is expected in the next 96 hours. 

Mitigation:
------------

However are several immediate options to mitigate this issue until that time:

1)	Use mod_headers to dis-allow the use of Range headers:

		RequestHeader unset Range 

	Note that this may break certain clients - such as those used for
	e-Readers and progressive/http-streaming video.

2)	Use mod_rewrite to limit the number of ranges:

	RewriteCond %{HTTP:range} !^bytes=[^,]+(,[^,]+){0,4}$
	RewriteRule .* - [F]

3)	Limit the size of the request field to a few hundred bytes. Note that while this
	keeps the offending Range header short - it may break other headers; such as sizable
	cookies or security fields. 

		LimitRequestFieldSize 200

	Note that as the attack evolves in the field you are likely to have
	to further limit this and/or impose other LimitRequestFields limits.

	See: 	http://httpd.apache.org/docs/2.2/mod/core.htm...

3)	Deploy a Range header count module as a temporary stopgap measure:

	http://people.apache.org/~dirkx/mod_rangecnt....

5)	Apply any of the current patches under discussion - such as:

	http://mail-archives.apache.org/mod_mbox/http...


Actions:
-----------
Apache HTTPD users are advised to investigate wether they are vulnerable (e.g. allow use of the Range header )and consider implementing any of the above mitigations immediately. 

When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.

Planning:
-------------

This advisory will be updated when a fix/patch or new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 96 hours. Note that, while popular, Apache 1.3 is deprecated.
Eric Covener 1314191887Wed, 24 Aug 2011 13:18:07 +0000 (UTC)
> *       Is this the right list (and order) of the mitigations - or should ReWrite be first ?
FWIW I don't like rewrite first because it's so unruly with being
defined once per vhost + main server + RewriteEngine on.

I like RequestHeader simplicity, and could be combined with SetEnvIf
to only zap long malicious looking headers.
Eric Covener 1314192591Wed, 24 Aug 2011 13:29:51 +0000 (UTC)
On Wed, Aug 24, 2011 at 9:17 AM, Eric Covener  wrote:
>> *       Is this the right list (and order) of the mitigations - or should ReWrite be first ?
> FWIW I don't like rewrite first because it's so unruly with being
> defined once per vhost + main server + RewriteEngine on.
>
> I like RequestHeader simplicity, and could be combined with SetEnvIf
> to only zap long malicious looking headers.
>e.g.

SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range
CustomLog logs/range.log "%r %{Range}i %{bad-range}e"

 printf "GET / HTTP/1.1\r\nHost:
localhost\r\nRange:bytes=0-1,2-3,4-5,5-6,7-9,10-12,11-99,44\r\n\r\n" |
nc localhost 80

 GET / HTTP/1.1 - 1

printf "GET / HTTP/1.1\r\nHost:
localhost\r\nRange:bytes=0-1,2-3,4-5\r\n\r\n" | nc localhost 80
GET / HTTP/1.1 bytes=0-1,2-3,4-5 -
Eric Covener 1314192663Wed, 24 Aug 2011 13:31:03 +0000 (UTC)
On Wed, Aug 24, 2011 at 9:29 AM, Eric Covener  wrote:
> On Wed, Aug 24, 2011 at 9:17 AM, Eric Covener  wrote:
>>> *       Is this the right list (and order) of the mitigations - or should ReWrite be first ?
>> FWIW I don't like rewrite first because it's so unruly with being
>> defined once per vhost + main server + RewriteEngine on.
>>
>> I like RequestHeader simplicity, and could be combined with SetEnvIf
>> to only zap long malicious looking headers.
>>
> e.g.
>
> SetEnvIf Range (,.*?){5,} bad-range=1
> RequestHeader unset Range env=bad-range
> CustomLog logs/range.log "%r %{Range}i %{bad-range}e"
>
>  printf "GET / HTTP/1.1\r\nHost:
> localhost\r\nRange:bytes=0-1,2-3,4-5,5-6,7-9,10-12,11-99,44\r\n\r\n" |
> nc localhost 80
>
>  GET / HTTP/1.1 - 1
>
> printf "GET / HTTP/1.1\r\nHost:
> localhost\r\nRange:bytes=0-1,2-3,4-5\r\n\r\n" | nc localhost 80
> GET / HTTP/1.1 bytes=0-1,2-3,4-5 -
>Or more like Ruedigers:

SetEnvIf Range (,[^,]*){5,} bad-range=1
Nick Kew 1314217068Wed, 24 Aug 2011 20:17:48 +0000 (UTC)
On Wed, 24 Aug 2011 09:30:34 -0400
Eric Covener  wrote:

> Or more like Ruedigers:
> 
> SetEnvIf Range (,[^,]*){5,} bad-range=1Or just
Untaint HTTP_RANGE (,[^,]*){5,}

Is it time to re-suggest dropping mod_taint into trunk?
Dirk-Willem van Gulik 1314196750Wed, 24 Aug 2011 14:39:10 +0000 (UTC)
Folks,

Can I have a few +1's on below - or feedback on what we'd like to have changed ?

*	Would like to get this out in an hour or so ?

*	FIne with the 48 hours commitment of an update ?

Dw.



Title:    CVE-2011-3192: Range header DoS vulnerability Apache HTTPD 1.3/2.x
Date:     20110824 1600Z
Product:  Apache HTTPD Web Server
Versions: Apache 1.3 all versions, Apache 2 all versions

Description:
------------

A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server:

     http://seclists.org/fulldisclosure/2011/Aug/1...  

An attack tool is circulating in the wild. Active use of this tools has been observed.

The attack can be done remotely and with a modest number of requests can cause very significant memory and CPU usage on the server. 

The default Apache HTTPD installation is vulnerable.

There is currently no patch/new version of Apache HTTPD which fixes this vulnerability. This advisory will be updated when a long term fix is available. 

A full fix is expected in the next 48 hours. 

Mitigation:
------------

However there are several immediate options to mitigate this issue until that time:

1) Use mod_rewrite to limit the number of ranges:

   Option 1L
          RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
          RewriteRule .* - [F]

   Option 2:
          SetEnvIf Range (,.*?){5,} bad-range=1
          RequestHeader unset Range env=bad-range
          # optional logging.
          CustomLog logs/range.log "%r %{Range}i %{bad-range}e"

2) Limit the size of the request field to a few hundred bytes. Note that while this
   keeps the offending Range header short - it may break other headers; such as 
   sizeable cookies or security fields. 

          LimitRequestFieldSize 200

   Note that as the attack evolves in the field you are likely to have
   to further limit this and/or impose other LimitRequestFields limits.

   See:      http://httpd.apache.org/docs/2.2/mod/core.htm...

3) Use mod_headers to dis-allow the use of Range headers:

          RequestHeader unset Range 

   Note that this may break certain clients - such as those used for
   e-Readers and progressive/http-streaming video.

4) Deploy a Range header count module as a temporary stopgap measure:

     http://people.apache.org/~dirkx/mod_rangecnt....

5) Apply any of the current patches under discussion - such as:

   http://mail-archives.apache.org/mod_mbox/http...

Actions:
-----------
Apache HTTPD users who are concerned about a DoS attack against their server should consider implementing any of the above mitigations immediately. 

When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.

Planning:
-------------
This advisory will be updated when a fix/patch or new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 48 hours. Note that, while popular, Apache 1.3 is deprecated.
"Plüm, Rüdiger, VF-Group" 1314197212Wed, 24 Aug 2011 14:46:52 +0000 (UTC)
> -----Original Message-----
> From: Dirk-Willem van Gulik [mailto:] 
> Sent: Mittwoch, 24. August 2011 16:36
> To: 
> Subject: VOTES please -- CVE-2011-3192: Range header DoS 
> vulnerability in Apache 1.3 and Apache 2 (Final-5)
> 
> Folks,
> 
> Can I have a few +1's on below - or feedback on what we'd 
> like to have changed ?
> 
> *	Would like to get this out in an hour or so ?
> 
> *	FIne with the 48 hours commitment of an update ?
> 
> Dw.
> 
> 
> 
> Title:    CVE-2011-3192: Range header DoS vulnerability 
> Apache HTTPD 1.3/2.x
> Date:     20110824 1600Z
> Product:  Apache HTTPD Web Server
> Versions: Apache 1.3 all versions, Apache 2 all versions
> 
> Description:
> ------------
> 
> A denial of service vulnerability has been found in the way 
> the multiple overlapping ranges are handled by the Apache 
> HTTPD server:
> 
>      http://seclists.org/fulldisclosure/2011/Aug/1...  
> 
> An attack tool is circulating in the wild. Active use of this 
> tools has been observed.
> 
> The attack can be done remotely and with a modest number of 
> requests can cause very significant memory and CPU usage on 
> the server. 
> 
> The default Apache HTTPD installation is vulnerable.
> 
> There is currently no patch/new version of Apache HTTPD which 
> fixes this vulnerability. This advisory will be updated when 
> a long term fix is available. 
> 
> A full fix is expected in the next 48 hours. 
> 
> Mitigation:
> ------------
> 
> However there are several immediate options to mitigate this 
> issue until that time:
> 
> 1) Use mod_rewrite to limit the number of ranges:
> 
>    Option 1L
>           RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
>           RewriteRule .* - [F]
> 
>    Option 2:
>           SetEnvIf Range (,.*?){5,} bad-range=1
>           RequestHeader unset Range env=bad-range
>           # optional logging.
>           CustomLog logs/range.log "%r %{Range}i %{bad-range}e"Shouldn't it be a conditional logging?

CustomLog logs/range.log "%r %{Range}i" env=bad-range

Otherwise looks good. +1.

Regards

Rüdiger
Eric Covener 1314197612Wed, 24 Aug 2011 14:53:32 +0000 (UTC)
> CustomLog logs/range.log "%r %{Range}i" env=bad-range
>Actually I was only using that to show/debug the result of the
directives, did not occur that folks would also want to log these!

Of course that makes sense though.

Unfortunately we lose the range header in the log when we zap it, so
logging it is not really so useful in concert with the conditional.
so probably just wise to collect them under common logformat:

SetEnvIf Range (,[^,]*){5,} bad-range=1
RequestHeader unset Range env=bad-range
CustomLog logs/range.log common env=bad-range
Dirk-Willem van Gulik 1314197842Wed, 24 Aug 2011 14:57:22 +0000 (UTC)
Various suggest on-list and off-list fixes applied. Thanks all.

A few more +1's would be nice :)

Dw.





Title:    CVE-2011-3192: Range header DoS vulnerability Apache HTTPD 1.3/2.x
          Apache HTTPD Security ADVISORY

Date:     20110824 1600Z
Product:  Apache HTTPD Web Server
Versions: Apache 1.3 all versions, Apache 2 all versions

Description:
------------

A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server:

     http://seclists.org/fulldisclosure/2011/Aug/1...  

An attack tool is circulating in the wild. Active use of this tools has been observed.

The attack can be done remotely and with a modest number of requests can cause very significant memory and CPU usage on the server. 

The default Apache HTTPD installation is vulnerable.

There is currently no patch/new version of Apache HTTPD which fixes this vulnerability. This advisory will be updated when a long term fix is available. 

A full fix is expected in the next 48 hours. 

Mitigation:
------------

However there are several immediate options to mitigate this issue until that time. 

1) Use mod_rewrite to limit the number of ranges:

   Option 1:
          # drop Range header when more than 5 ranges.
          # CVE-2011-3192
          SetEnvIf Range (,.*?){5,} bad-range=1
          RequestHeader unset Range env=bad-range

          # optional logging.
          CustomLog logs/range-CVE-2011-3192.log common env=bad-range

   Option 2:
          # Reject request when more than 5 ranges in the Range: header.
          # CVE-2011-3192
          #
          RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
          RewriteRule .* - [F]

   The number 5 is arbitrary. Several 10's should not be an issue and may be
   required for sites which for example serve PDFs to very high end eReaders
   or use things such complex http based video streaming.

2) Limit the size of the request field to a few hundred bytes. Note that while this
   keeps the offending Range header short - it may break other headers; such as 
   sizeable cookies or security fields. 

          LimitRequestFieldSize 200

   Note that as the attack evolves in the field you are likely to have
   to further limit this and/or impose other LimitRequestFields limits.

   See: http://httpd.apache.org/docs/2.2/mod/core.htm...

3) Use mod_headers to completely dis-allow the use of Range headers:

          RequestHeader unset Range 

   Note that this may break certain clients - such as those used for
   e-Readers and progressive/http-streaming video.

4) Deploy a Range header count module as a temporary stopgap measure:

     http://people.apache.org/~dirkx/mod_rangecnt....

   Precompiled binaries for some platforms are available at:

	http://people.apache.org/~dirkx/BINARIES.txt

5) Apply any of the current patches under discussion - such as:

   http://mail-archives.apache.org/mod_mbox/http...

Actions:
-----------
Apache HTTPD users who are concerned about a DoS attack against their server should consider implementing any of the above mitigations immediately. 

When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.

Planning:
-------------
This advisory will be updated when new information, a patch or a new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 48 hours. Note that, while popular, Apache 1.3 is deprecated.
Eric Covener 1314198008Wed, 24 Aug 2011 15:00:08 +0000 (UTC)
see inline updatesOn Wed, Aug 24, 2011 at 10:56 AM, Dirk-Willem van Gulik
 wrote:
> Various suggest on-list and off-list fixes applied. Thanks all.
>
> A few more +1's would be nice :)
>
> Dw.
>
>
>
>
>
> Title:    CVE-2011-3192: Range header DoS vulnerability Apache HTTPD 1.3/2.x
>          Apache HTTPD Security ADVISORY
>
> Date:     20110824 1600Z
> Product:  Apache HTTPD Web Server
> Versions: Apache 1.3 all versions, Apache 2 all versions
>
> Description:
> ------------
>
> A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server:
>
>     http://seclists.org/fulldisclosure/2011/Aug/1...
>
> An attack tool is circulating in the wild. Active use of this tools has been observed.
>
> The attack can be done remotely and with a modest number of requests can cause very significant memory and CPU usage on the server.
>
> The default Apache HTTPD installation is vulnerable.
>
> There is currently no patch/new version of Apache HTTPD which fixes this vulnerability. This advisory will be updated when a long term fix is available.
>
> A full fix is expected in the next 48 hours.
>
> Mitigation:
> ------------
>
> However there are several immediate options to mitigate this issue until that time.
>
> 1) Use mod_rewrite to limit the number of ranges:^ clarify due to directive addition>
>   Option 1:
>          # drop Range header when more than 5 ranges.
>          # CVE-2011-3192
>          SetEnvIf Range (,.*?){5,} bad-range=1
>          RequestHeader unset Range env=bad-range
>
>          # optional logging.
>          CustomLog logs/range-CVE-2011-3192.log common env=bad-range
>
>   Option 2:
>          # Reject request when more than 5 ranges in the Range: header.
>          # CVE-2011-3192. Must be added to each VirtualHost and once
>          # in the base configuration.+RewriteEngine on>          RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
>          RewriteRule .* - [F]
>
>   The number 5 is arbitrary. Several 10's should not be an issue and may be
>   required for sites which for example serve PDFs to very high end eReaders
>   or use things such complex http based video streaming.
>
> 2) Limit the size of the request field to a few hundred bytes. Note that while this
>   keeps the offending Range header short - it may break other headers; such as
>   sizeable cookies or security fields.
>
>          LimitRequestFieldSize 200
>
>   Note that as the attack evolves in the field you are likely to have
>   to further limit this and/or impose other LimitRequestFields limits.
>
>   See: http://httpd.apache.org/docs/2.2/mod/core.htm...
>
> 3) Use mod_headers to completely dis-allow the use of Range headers:
>
>          RequestHeader unset Range
>
>   Note that this may break certain clients - such as those used for
>   e-Readers and progressive/http-streaming video.
>
> 4) Deploy a Range header count module as a temporary stopgap measure:
>
>     http://people.apache.org/~dirkx/mod_rangecnt....
>
>   Precompiled binaries for some platforms are available at:
>
>        http://people.apache.org/~dirkx/BINARIES.txt
>
> 5) Apply any of the current patches under discussion - such as:
>
>   http://mail-archives.apache.org/mod_mbox/http...
>
> Actions:
> -----------
> Apache HTTPD users who are concerned about a DoS attack against their server should consider implementing any of the above mitigations immediately.
>
> When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.
>
> Planning:
> -------------
> This advisory will be updated when new information, a patch or a new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 48 hours. Note that, while popular, Apache 1.3 is deprecated.
>
>
Jim Jagielski 1314198570Wed, 24 Aug 2011 15:09:30 +0000 (UTC)
With the current fixes, +1On Aug 24, 2011, at 10:56 AM, Dirk-Willem van Gulik wrote:

> Various suggest on-list and off-list fixes applied. Thanks all.
> 
> A few more +1's would be nice :)
> 
> Dw.
> 
> 
> 
> 
> 
> Title:    CVE-2011-3192: Range header DoS vulnerability Apache HTTPD 1.3/2.x
>          Apache HTTPD Security ADVISORY
> 
> Date:     20110824 1600Z
> Product:  Apache HTTPD Web Server
> Versions: Apache 1.3 all versions, Apache 2 all versions
> 
> Description:
> ------------
> 
> A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server:
> 
>     http://seclists.org/fulldisclosure/2011/Aug/1...  
> 
> An attack tool is circulating in the wild. Active use of this tools has been observed.
> 
> The attack can be done remotely and with a modest number of requests can cause very significant memory and CPU usage on the server. 
> 
> The default Apache HTTPD installation is vulnerable.
> 
> There is currently no patch/new version of Apache HTTPD which fixes this vulnerability. This advisory will be updated when a long term fix is available. 
> 
> A full fix is expected in the next 48 hours. 
> 
> Mitigation:
> ------------
> 
> However there are several immediate options to mitigate this issue until that time. 
> 
> 1) Use mod_rewrite to limit the number of ranges:
> 
>   Option 1:
>          # drop Range header when more than 5 ranges.
>          # CVE-2011-3192
>          SetEnvIf Range (,.*?){5,} bad-range=1
>          RequestHeader unset Range env=bad-range
> 
>          # optional logging.
>          CustomLog logs/range-CVE-2011-3192.log common env=bad-range
> 
>   Option 2:
>          # Reject request when more than 5 ranges in the Range: header.
>          # CVE-2011-3192
>          #
>          RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
>          RewriteRule .* - [F]
> 
>   The number 5 is arbitrary. Several 10's should not be an issue and may be
>   required for sites which for example serve PDFs to very high end eReaders
>   or use things such complex http based video streaming.
> 
> 2) Limit the size of the request field to a few hundred bytes. Note that while this
>   keeps the offending Range header short - it may break other headers; such as 
>   sizeable cookies or security fields. 
> 
>          LimitRequestFieldSize 200
> 
>   Note that as the attack evolves in the field you are likely to have
>   to further limit this and/or impose other LimitRequestFields limits.
> 
>   See: http://httpd.apache.org/docs/2.2/mod/core.htm...
> 
> 3) Use mod_headers to completely dis-allow the use of Range headers:
> 
>          RequestHeader unset Range 
> 
>   Note that this may break certain clients - such as those used for
>   e-Readers and progressive/http-streaming video.
> 
> 4) Deploy a Range header count module as a temporary stopgap measure:
> 
>     http://people.apache.org/~dirkx/mod_rangecnt....
> 
>   Precompiled binaries for some platforms are available at:
> 
> 	http://people.apache.org/~dirkx/BINARIES.txt
> 
> 5) Apply any of the current patches under discussion - such as:
> 
>   http://mail-archives.apache.org/mod_mbox/http...
> 
> Actions:
> -----------
> Apache HTTPD users who are concerned about a DoS attack against their server should consider implementing any of the above mitigations immediately. 
> 
> When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.
> 
> Planning:
> -------------
> This advisory will be updated when new information, a patch or a new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 48 hours. Note that, while popular, Apache 1.3 is deprecated.
>
Greg Ames 1314199439Wed, 24 Aug 2011 15:23:59 +0000 (UTC)
On Wed, Aug 24, 2011 at 10:56 AM, Dirk-Willem van Gulik <
 wrote:

+1 with Eric's edits. specifically,>
> 1) Use mod_rewrite to limit the number of ranges:
>Option 1 doesn't use mod_rewrite.

  Option 1:>          # drop Range header when more than 5 ranges.
>          # CVE-2011-3192
>          SetEnvIf Range (,.*?){5,} bad-range=1
>          RequestHeader unset Range env=bad-range
>
>          # optional logging.
>          CustomLog logs/range-CVE-2011-3192.log common env=bad-range
>Greg
Dirk-WIllem van Gulik 1314192254Wed, 24 Aug 2011 13:24:14 +0000 (UTC)
On 24 Aug 2011, at 14:07, Dirk-WIllem van Gulik wrote:

*	Folks - do we also need to add Request-Range ?

*	Updated with Rudigers comments., Eric, Florians, Marks.

*	Consensus that the deflate stuff needs to go out reflected.

*	More Comments please. Esp. on the quality and realisticness of the mitigtions.

*	Timeline mentioning fine (we've never done that before) -- or best avoided ?

My plan is to wait for the US to fully wake up - and then call around 1500Z for a few quick +1's to get this out - ideally before 1600 zulu.

Thanks,

Dw.







Title:	    CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2
Date:       20110824 1600Z
# Last Updated:  20110824 1600Z
Product:   Apache Web Server
Versions:  Apache 1.3 all versions, Apache 2 all versions

Description:
------------

A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server (http://seclists.org/fulldisclosure/2011/Aug/1...).  

An attack tool is circulating in the wild. Active use of this tools has been observed.

The attack can be done remotely and with a modest number of requests leads to very significant memory and CPU usage. 

The default Apache HTTPD installation is vulnerable.

There is currently no patch/new version of Apache HTTPD which fixes this vulnerability. This advisory will be updated when a long term fix is available. A full fix is expected in the next 48 hours. 

Mitigation:
------------

However there are several immediate options to mitigate this issue until that time:

1)	Use mod_headers to dis-allow the use of Range headers:

		RequestHeader unset Range 

	Note that this may break certain clients - such as those used for
	e-Readers and progressive/http-streaming video.

2)	Use mod_rewrite to limit the number of ranges:

		RewriteCond %{HTTP:range} !^bytes=[^,]+(,[^,]+){0,4}$
		RewriteRule .* - [F]

3)	Limit the size of the request field to a few hundred bytes. Note that while this
	keeps the offending Range header short - it may break other headers; such as sizable
	cookies or security fields. 

		LimitRequestFieldSize 200

	Note that as the attack evolves in the field you are likely to have
	to further limit this and/or impose other LimitRequestFields limits.

	See: 	http://httpd.apache.org/docs/2.2/mod/core.htm...

4)	Deploy a Range header count module as a temporary stopgap measure:

	http://people.apache.org/~dirkx/mod_rangecnt....

5)	Apply any of the current patches under discussion - such as:

	http://mail-archives.apache.org/mod_mbox/http...


Actions:
-----------
Apache HTTPD users who are concerned about a DoS attack against their server should consider implementing any of the above mitigations immediately. 

When using a third party attack tool to verify vulnerability - know that most of the versions in the wild currently check for the presence of mod_deflate; and will (mis)report that your server is not vulnerable if this module is not present. This vulnerability is not dependent on presence or absence of that module.

Planning:
-------------

This advisory will be updated when a fix/patch or new release is available. A patch or new apache release for Apache 2.0 and 2.2 is expected in the next 48 hours. Note that, while popular, Apache 1.3 is deprecated.
Guenter Knauf 1314196494Wed, 24 Aug 2011 14:34:54 +0000 (UTC)
Dirk,
Am 24.08.2011 15:23, schrieb Dirk-WIllem van Gulik:
> 4)	Deploy a Range header count module as a temporary stopgap measure:
>
> 	http://people.apache.org/~dirkx/mod_rangecnt....can you please apply:
--- mod_rangecnt.c.orig	Wed Aug 24 16:25:34 2011
+++ mod_rangecnt.c	Wed Aug 24 15:26:48 2011
@@ -22,6 +22,7 @@
  #include "httpd.h"
  #include "http_config.h"
  #include "http_log.h"
+#include "http_protocol.h"

  #ifndef MAXRANGEHEADERS
  #define MAXRANGEHEADERS (5)

which I need on NetWare in order to get ap_hook_post_read_request() proto;

and maybe we should also add links to mod_rangecnt binaries?
for Netware:
http://people.apache.org/~fuankg/httpd/apache...
http://people.apache.org/~fuankg/httpd/apache...

Gregg, are you up to provide Win32 binaries too?

Gün.
Dirk-Willem van Gulik 1314196963Wed, 24 Aug 2011 14:42:43 +0000 (UTC)
On 24 Aug 2011, at 15:34, Guenter Knauf wrote:

> can you please apply:
> --- mod_rangecnt.c.orig	Wed Aug 24 16:25:34 2011
> +++ mod_rangecnt.c	Wed Aug 24 15:26:48 2011Done.> which I need on NetWare in order to get ap_hook_post_read_request() proto;
> 
> and maybe we should also add links to mod_rangecnt binaries?
> for Netware:
> http://people.apache.org/~fuankg/httpd/apache...
> http://people.apache.org/~fuankg/httpd/apache...Added pointers.

Dw.
"Plüm, Rüdiger, VF-Group" 1314195650Wed, 24 Aug 2011 14:20:50 +0000 (UTC)
Reverse the order a litte bit:

2) , 3), 1) (as 1) is likely to break the most things compared to 2) and 3))

Regarding 2) see the ongoing discussion between Eric and me to find the correct expression.

Regards

Rüdiger> -----Original Message-----
> From: Dirk-WIllem van Gulik
> Sent: Mittwoch, 24. August 2011 15:08
> To: Dirk-Willem van Gulik
> Cc: ; 
> Subject: Re: CVE-2011-3192: Range header DoS vulnerability in 
> Apache 1.3 and Apache 2 (DRAFT-3)
> 
> *	Folks - do we also need to add Request-Range ?
> 
> *	Updated with Rudigers comments., Eric, Florians
> 
> *	Consensus that the deflate stuff needs to go out reflected.
> 
> *	More Comments please. Esp. on the quality and 
> realisticness of the mitigtions.
> 
> *	Is this the right list (and order) of the mitigations - 
> or should ReWrite be first ?
> 
> *	Timeline mentioning fine (we've never done that before) 
> -- or best avoided ?
> 
> My plan is to wait for the US to fully wake up - and then 
> call for a few quick +1's to get this out - ideally before 1600 zulu.
> 
> Thanks,
> 
> Dw.
> 
> 
> 
> 
> 
> 
> 
> Title:	    CVE-2011-3192: Range header DoS 
> vulnerability in Apache 1.3 and Apache 2
> Date:       20110824 1600Z
> # Last Updated:  20110824 1600Z
> Product:   Apache Web Server
> Versions:  Apache 1.3 all versions, Apache 2 all versions
> 
> Description:
> ------------
> 
> A denial of service vulnerability has been found in the way 
> the multiple overlapping ranges are handled by apache 
> (http://seclists.org/fulldisclosure/2011/Aug/1...).  An attack 
> tool is circulating in the wild. Active use of this tools has 
> been observed.
> 
> The attack can be done remotely and with a modest number of 
> requests leads to very significant memory and CPU usage. 
> 
> The default apache installation is vulnerable.
> 
> There is currently no patch/new version of apache which fixes 
> this vulnerability. This advisory will be updated when a long 
> term fix is available. A fix is expected in the next 96 hours. 
> 
> Mitigation:
> ------------
> 
> However are several immediate options to mitigate this issue 
> until that time:
> 
> 1)	Use mod_headers to dis-allow the use of Range headers:
> 
> 		RequestHeader unset Range 
> 
> 	Note that this may break certain clients - such as 
> those used for
> 	e-Readers and progressive/http-streaming video.
> 
> 2)	Use mod_rewrite to limit the number of ranges:
> 
> 	RewriteCond %{HTTP:range} !^bytes=[^,]+(,[^,]+){0,4}$
> 	RewriteRule .* - [F]
> 
> 3)	Limit the size of the request field to a few hundred 
> bytes. Note that while this
> 	keeps the offending Range header short - it may break 
> other headers; such as sizable
> 	cookies or security fields. 
> 
> 		LimitRequestFieldSize 200
> 
> 	Note that as the attack evolves in the field you are 
> likely to have
> 	to further limit this and/or impose other 
> LimitRequestFields limits.
> 
> 	See: 	
> http://httpd.apache.org/docs/2.2/mod/core.htm...
> 
> 3)	Deploy a Range header count module as a temporary 
> stopgap measure:
> 
> 	http://people.apache.org/~dirkx/mod_rangecnt....
> 
> 5)	Apply any of the current patches under discussion - such as:
> 
> 	
> http://mail-archives.apache.org/mod_mbox/http...
> /%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.g
> mail.com%3e
> 
> 
> Actions:
> -----------
> Apache HTTPD users are advised to investigate wether they are 
> vulnerable (e.g. allow use of the Range header )and consider 
> implementing any of the above mitigations immediately. 
> 
> When using a third party attack tool to verify vulnerability 
> - know that most of the versions in the wild currently check 
> for the presence of mod_deflate; and will (mis)report that 
> your server is not vulnerable if this module is not present. 
> This vulnerability is not dependent on presence or absence of 
> that module.
> 
> Planning:
> -------------
> 
> This advisory will be updated when a fix/patch or new release 
> is available. A patch or new apache release for Apache 2.0 
> and 2.2 is expected in the next 96 hours. Note that, while 
> popular, Apache 1.3 is deprecated. 
> 
> 
> 
> 
> 
> 
> 
>
Ad
Home | About | Privacy