Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have read in many places (for example) on the latest Apache exploit that could shut down about 60% of websites online.

Since there is no patch for Apache yet, what would be the best option to defend my server from such attacks? after googling the subject for a while, I've found few different solutions (this one looks good), on the configuration level. But as someone who's not a real Apache savvy, I can't really judge how they will effect my server's performance.

I'll be glad for any tip or advice.

share|improve this question

migrated from stackoverflow.com Aug 28 '11 at 15:52

This question came from our site for professional and enthusiast programmers.

2  
The exploit your link describes is about the regular Apache web server, not Tomcat. It's not the same thing. –  Michael Madsen Aug 28 '11 at 15:02
1  
You are right of course. Edited. –  Ido.Co Aug 28 '11 at 15:06
1  
And this is another good link on the subject - blog.spiderlabs.com/2011/08/… –  Ido.Co Aug 28 '11 at 15:15

1 Answer 1

up vote 4 down vote accepted

There are known workarounds for this exploit, none of which have a substantial impact on web server performance (especially when compared to having your site knocked down).
Please try a google search (or a brief read of the Full Disclosure mailing list archives) next time before asking a question.

For reference, from the FD thread discussing the issue:

Option 1: (Apache 2.0 and 2.2)

     # Drop the Range header when more than 5 ranges.
     # CVE-2011-3192
     SetEnvIf Range (,.*?){5,} bad-range=1
     RequestHeader unset Range env=bad-range

     # optional logging.
     CustomLog logs/range-CVE-2011-3192.log common env=bad-range

Option 2: (Also for Apache 1.3)

     # Reject request when more than 5 ranges in the Range: header.
     # CVE-2011-3192
     #
     RewriteEngine on
     RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
     RewriteRule .* - [F]
share|improve this answer
4  
I'm a tiny bit offended, since I've googled the subject, and even attached to two solutions you wrote to my question (it's the second link). my question was more about how these changes will effect the servers behavior or suggesting other solutions. –  Ido.Co Aug 28 '11 at 16:33
3  
I'm sorry if my curt reply offended you, but those are the solutions absent patching httpd, and as indicated they have no substantial performance impact (which is something Google can tell you, and why my answer is so brief). FYI Incorporating the solutions in my answer is (as indicated) for reference so that future people searching for this information do not have to rely on links which may cease to work one day. –  voretaq7 Aug 28 '11 at 16:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.