Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

so one of the mitigations for this advisory was:

1) Use SetEnvIf or mod_rewrite to detect a large number of ranges and then either ignore the Range: header or reject the request.

Option 1: (Apache 2.0 and 2.2)

      # Drop the Range header when more than 5 ranges.
      # CVE-2011-3192
      SetEnvIf Range (,.*?){5,} bad-range=1
      RequestHeader unset Range env=bad-range

      # optional logging.

      CustomLog logs/range-CVE-2011-3192.log common env=bad-range

Now when I add this to my httpd.conf:

<IfModule mod_setenvif.c>
SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range

</IfModule>

I get this error when restarting Apache:

"Invalid command 'RequestHeader', perhaps misspelled or defined by a module not included in the server configuration"

The SetEvnIf module seems to be loaded.

What is wrong with that parameter?

Version is Apache/2.2.14 .

Link to the advisory is: http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/browser

also, would Tomcat be vulnerable to this?

tia!

share|improve this question

2 Answers 2

RequestHeader requires you to load mod_headers

share|improve this answer

as per DerfK's answer, you need to load mod_headers -- a la

LoadModule headers_module modules/mod_headers.so

in your conf file before the call to RequestHeader

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.