Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

To address the current apache vulnerability (CVE-2011-3192) I am trying to mitigate with setenvif as referenced here.

Is there any way to have this apply to all the virtual hosts instead of adding those statements to each vhost?

share|improve this question

3 Answers 3

If you are running Apache on *nix, you can use sed as a workaround to insert what you want after finding a pattern, something like this:

sed '/<VirtualHost/ a\ \tSetEnvIf\ Range\ \(,.*?\){5,}\ bad-range=1\n\tRequestHeader\ unset\ Range\ env=bad-range' /etc/httpd/conf.d/vhost.conf
  • a\ text means that append text after founding pattern <VirtualHost
  • \n - a new line
  • \t - a tab
  • special characters such as: spaces, brackets, ... are escaped with a backslash

If you sastify with it, 'really' edit with sed -i.

share|improve this answer

Server config is a valid context for SetEnvIf; putting it in your main server config file instead of in <VirtualHost> blocks should work just fine.

share|improve this answer
But the virtual host doesn't seem to inherit the settings. Or maybe it is just not inheriting the custom log? –  Ted S Aug 25 '11 at 5:43

Expanding on 'Shane Madden's answer: If you're talking about applying this mitigation:

# Drop the Range header when more than 5 ranges.
# CVE-2011-3192
SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range

BOTH of these are available in 'server config' context:



share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.