I have read in many places (for example) on the latest Apache exploit that could shut down about 60% of websites online.

Since there is no patch for Apache yet, what would be the best option to defend my server from such attacks? after googling the subject for a while, I've found few different solutions (this one looks good), on the configuration level. But as someone who's not a real Apache savvy, I can't really judge how they will effect my server's performance.

I'll be glad for any tip or advice.

migrated from stackoverflow.com Aug 28 '11 at 15:52

This question came from our site for professional and enthusiast programmers.

  • 2
    The exploit your link describes is about the regular Apache web server, not Tomcat. It's not the same thing. – Michael Madsen Aug 28 '11 at 15:02
  • 1
    You are right of course. Edited. – Ido.Co Aug 28 '11 at 15:06
  • 1
    And this is another good link on the subject - blog.spiderlabs.com/2011/08/… – Ido.Co Aug 28 '11 at 15:15

There are known workarounds for this exploit, none of which have a substantial impact on web server performance (especially when compared to having your site knocked down).
Please try a google search (or a brief read of the Full Disclosure mailing list archives) next time before asking a question.

For reference, from the FD thread discussing the issue:

Option 1: (Apache 2.0 and 2.2)

     # Drop the Range header when more than 5 ranges.
     # CVE-2011-3192
     SetEnvIf Range (,.*?){5,} bad-range=1
     RequestHeader unset Range env=bad-range

     # optional logging.
     CustomLog logs/range-CVE-2011-3192.log common env=bad-range

Option 2: (Also for Apache 1.3)

     # Reject request when more than 5 ranges in the Range: header.
     # CVE-2011-3192
     RewriteEngine on
     RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
     RewriteRule .* - [F]
  • 4
    I'm a tiny bit offended, since I've googled the subject, and even attached to two solutions you wrote to my question (it's the second link). my question was more about how these changes will effect the servers behavior or suggesting other solutions. – Ido.Co Aug 28 '11 at 16:33
  • 3
    I'm sorry if my curt reply offended you, but those are the solutions absent patching httpd, and as indicated they have no substantial performance impact (which is something Google can tell you, and why my answer is so brief). FYI Incorporating the solutions in my answer is (as indicated) for reference so that future people searching for this information do not have to rely on links which may cease to work one day. – voretaq7 Aug 28 '11 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.