Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been trying to apply the suggested fix to apache for CVE-2011-3192 which was to add to httpd.conf

# Drop the Range header when more than 5 ranges. 
# CVE-2011-3192 
SetEnvIf Range (,.*?){5,} bad-range=1 
RequestHeader unset Range env=bad-range

However, in Apache 2.0.59, configtest says

Syntax error on line .... 
header unset takes two arguments

We still require the use of the range header so to unset the whole range portion is not really an option. Any thoughts on getting this to work?

share|improve this question
    
Do you have the headers (mod_headers) mod enabled? –  Tom Gee Aug 25 '11 at 19:44

1 Answer 1

up vote 3 down vote accepted

Bad news! mod_headers in 2.0.59 doesn't seem to play nice with environment variables in its validation code.

It parses like this:

RequestHeader {action} {inhdr} {value} {envclause}

For unset, 2.0.59 validates like this, scrapping a directive if it has a third argument (value) after the directive name:

if (new->action == hdr_unset) {
    if (value)
        return "header unset takes two arguments";
}

So, RequestHeader unset Range works, and RequestHeader unset Range bytes=0-1000 breaks as intended.. but RequestHeader unset Range env=bad-range also breaks.

Someone figured that out somewhere along the line, and current versions do this, instead - putting the arguments where they belong:

if (new->action == hdr_unset) {
    if (value) {
        if (envclause) {
            return "header unset takes two arguments";
        }
        envclause = value;
        value = NULL;
    }
}

So, it's still parsing the envclause into the value position, but since unset doesn't take a value, it rearranges accordingly. So, now, RequestHeader unset Range env=bad-range works, but RequestHeader unset Range bytes=0-1000 env=bad-range still throws a validation error.. and RequestHeader unset Range bytes=0-1000 probably just blows up at runtime.


To fix, there's no shortage of bad options - patching then recompiling mod_headers to work correctly is one option, or just flat-out upgrading Apache. But, it might be worth a shot to empty the header with set (no validation bugs), instead of using unset:

RequestHeader set Range "badrange" env=bad-range

On the Apache 2.2 I checked on, junk data in the "Range" field will simply be ignored; in essence, an effective unset.

share|improve this answer
    
Many, many thank for this comprehensive answer. This issue became a bit of a headache for us and we actually found the best option for us was to use the mod_rangecnt option as presented in the announcement. This curl command is useful for testing to see if a site returns a 206 and maybe vulnerable, or in the case of the a successful mod_rangecnt implementation a 416 "curl -H HEAD -H Range:bytes=5-0,5-1,5-2,5-3,5-4,5-5,5-6,5-7 --dump-header - <hostname>" –  M Bishop Sep 8 '11 at 14:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.