Apache 项目日前发布了一个拒绝服务(DoS)漏洞警告,该漏洞可让攻击者轻松的让 Apache 软件拒绝服务,该漏洞影响 Apache 的所有版本。而且坊间已经流传着这样的攻击工具,该攻击可使 Apache Http Server 占用大多数的内存和 CPU,从而导致无法处理正常的请求。

采用默认方式安装的 Apache 非常容易受此攻击,而且目前还没有相应的补丁版本,预计在 48 小时内 Apache 会推出相应的补丁程序。
1) Use SetEnvIf or mod_rewrite to detect a large number of ranges and then
either ignore the Range: header or reject the request.

Option 1: (Apache 2.0 and 2.2)

# Drop the Range header when more than 5 ranges.
# CVE-2011-3192
SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range

# optional logging.
CustomLog logs/range-CVE-2011-3192.log common env=bad-range

Option 2: (Also for Apache 1.3)

# Reject request when more than 5 ranges in the Range: header.
# CVE-2011-3192
RewriteEngine on
RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
RewriteRule .* - [F]

The number 5 is arbitrary. Several 10's should not be an issue and may be
required for sites which for example serve PDFs to very high end eReaders
or use things such complex http based video streaming.

2) Limit the size of the request field to a few hundred bytes. Note that while
this keeps the offending Range header short - it may break other headers;
such as sizeable cookies or security fields.

LimitRequestFieldSize 200

Note that as the attack evolves in the field you are likely to have
to further limit this and/or impose other LimitRequestFields limits.

See: http://httpd.apache.org/docs/2.2/mod/core.html#limitreque...

3) Use mod_headers to completely dis-allow the use of Range headers:

RequestHeader unset Range

Note that this may break certain clients - such as those used for
e-Readers and progressive/http-streaming video.

4) Deploy a Range header count module as a temporary stopgap measure:


Precompiled binaries for some platforms are available at:


5) Apply any of the current patches under discussion - such as:


如需要转载请注明: 转载自eRic

原文地址: apache悲剧了.apache全系暴DoS漏洞.有解决方法.


4 Replies to “apache悲剧了.apache全系暴DoS漏洞.有解决方法.”

Comments are closed.