Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

To address the current apache vulnerability (CVE-2011-3192) I am trying to mitigate with setenvif as referenced here.

Is there any way to have this apply to all the virtual hosts instead of adding those statements to each vhost?

share|improve this question
add comment

3 Answers

If you are running Apache on *nix, you can use sed as a workaround to insert what you want after finding a pattern, something like this:

sed '/<VirtualHost/ a\ \tSetEnvIf\ Range\ \(,.*?\){5,}\ bad-range=1\n\tRequestHeader\ unset\ Range\ env=bad-range' /etc/httpd/conf.d/vhost.conf
  • a\ text means that append text after founding pattern <VirtualHost
  • \n - a new line
  • \t - a tab
  • special characters such as: spaces, brackets, ... are escaped with a backslash

If you sastify with it, 'really' edit with sed -i.

share|improve this answer
add comment

Server config is a valid context for SetEnvIf; putting it in your main server config file instead of in <VirtualHost> blocks should work just fine.

share|improve this answer
    
But the virtual host doesn't seem to inherit the settings. Or maybe it is just not inheriting the custom log? –  Ted S Aug 25 '11 at 5:43
add comment

Expanding on 'Shane Madden's answer: If you're talking about applying this mitigation:

# Drop the Range header when more than 5 ranges.
# CVE-2011-3192
SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range

BOTH of these are available in 'server config' context:

http://httpd.apache.org/docs/current/mod/mod_headers.html#requestheader

http://httpd.apache.org/docs/2.2/mod/mod_setenvif.html#setenvif

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.