Apache 项目日前发布了一个拒绝服务(DoS)漏洞警告,该漏洞可让攻击者轻松的让 Apache 软件拒绝服务,该漏洞影响 Apache 的所有版本。而且坊间已经流传着这样的攻击工具,该攻击可使 Apache Http Server 占用大多数的内存和 CPU,从而导致无法处理正常的请求。

采用默认方式安装的 Apache 非常容易受此攻击,而且目前还没有相应的补丁版本,预计在 48 小时内 Apache 会推出相应的补丁程序。
1) Use SetEnvIf or mod_rewrite to detect a large number of ranges and then
either ignore the Range: header or reject the request.

Option 1: (Apache 2.0 and 2.2)

# Drop the Range header when more than 5 ranges.
# CVE-2011-3192
SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range

# optional logging.
CustomLog logs/range-CVE-2011-3192.log common env=bad-range

Option 2: (Also for Apache 1.3)

# Reject request when more than 5 ranges in the Range: header.
# CVE-2011-3192
RewriteEngine on
RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
RewriteRule .* - [F]

The number 5 is arbitrary. Several 10's should not be an issue and may be
required for sites which for example serve PDFs to very high end eReaders
or use things such complex http based video streaming.

2) Limit the size of the request field to a few hundred bytes. Note that while
this keeps the offending Range header short - it may break other headers;
such as sizeable cookies or security fields.

LimitRequestFieldSize 200

Note that as the attack evolves in the field you are likely to have
to further limit this and/or impose other LimitRequestFields limits.

See: http://httpd.apache.org/docs/2.2/mod/core.html#limitreque...

3) Use mod_headers to completely dis-allow the use of Range headers:

RequestHeader unset Range

Note that this may break certain clients - such as those used for
e-Readers and progressive/http-streaming video.

4) Deploy a Range header count module as a temporary stopgap measure:


Precompiled binaries for some platforms are available at:


5) Apply any of the current patches under discussion - such as:



当然 第一个想到的就是DDOS攻击或者CC攻击。 但是DDOS攻击 不会导致CPU全满 CC攻击 也不会导致带宽全满。
从这2个方面下手 找了很久 也没找到解决的办法。后来 经过hostloc的CP指点。 发现 原来是被当作PHP-DDOS的肉鸡了。
为了防止再次被当作肉鸡 。 执行了以下脚本。这样 既是再被入侵 也不会再被肉了。
DNSIP=`cat /etc/resolv.conf |grep nameserver |awk 'NR==1{print $2 }'`
iptables -A OUTPUT -p udp -j DROP
iptables -I OUTPUT -p udp --dport 53 -d $DNSIP -j ACCEPT