Apache setenvif across all vhosts

Question

To address the current apache vulnerability (CVE-2011-3192) I am trying to mitigate with setenvif as referenced here.

Is there any way to have this apply to all the virtual hosts instead of adding those statements to each vhost?

Answer 1

If you are running Apache on *nix, you can use sed as a workaround to insert what you want after finding a pattern, something like this:

sed '/<VirtualHost/ a\ \tSetEnvIf\ Range\ \(,.*?\){5,}\ bad-range=1\n\tRequestHeader\ unset\ Range\ env=bad-range' /etc/httpd/conf.d/vhost.conf

• a\ text means that append text after founding pattern <VirtualHost
• \n - a new line
• \t - a tab
• special characters such as: spaces, brackets, ... are escaped with a backslash

If you sastify with it, 'really' edit with sed -i.

Answer 2

Server config is a valid context for SetEnvIf; putting it in your main server config file instead of in <VirtualHost> blocks should work just fine.

Answer 3

Expanding on 'Shane Madden's answer: If you're talking about applying this mitigation:

# Drop the Range header when more than 5 ranges.
# CVE-2011-3192
SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range

BOTH of these are available in 'server config' context:

http://httpd.apache.org/docs/current/mod/mod_headers.html#requestheader

http://httpd.apache.org/docs/2.2/mod/mod_setenvif.html#setenvif