Range header DoS vulnerability Apache HTTPD

Submitted on !datetime by !username.

IDs:

CVE-2011-3192

Keywords:

Range header DOS Apache

Description:

A denial of service vulnerability has been found in the way multiple overlapping ranges are handled by the Apache HTTPD server.

An attack tool is circulating in the wild. Active use of this tools has been observed.

Resolution:

To mitigate this issue Ergon has released the Update 4.2.3.3.

Do the following steps to secure your Airlock and back-end systems if it is not possible to directly update to version 4.2.3.3.

Login to the Airlock shell with user root
Open the file httpd.conf.in
# vi /opt/slt/ses/apache22/conf/httpd.conf.in
Search for "PdfsAsAttachments"
After the block
#*              *##if( ${virtualHost.dowloadPdfsAsAttachments} )
#*                     *## PDF-XSS mitigation (download PDF files as attachments)
#*                     *#Header set Content-Disposition "attachment;"env=pdf_doc
#*                   *#
#*              *##end
#*              *###insert the following snipplet
#*              *## Remove Range header if there are more than 5 ranges
#*              *#SetEnvIf Range (?:,.*?){5} bad-range=1
#*              *#RequestHeader unset Range env=bad-range
#*              *#
#*              *## unconditional remove of oldfashioned Request-Range header
#*              *#RequestHeader unset Request-Range
Restart the Configuration Center Agent
# svcadm restart svc:/site/slt_alec_agent
Login to the Configuration Center and activate the current configuration, so the httpd.conf is generated from the changed httpd.conf.in
Restart the Apache, so the new generated httpd.conf is activated
# zlogin ext
# /etc/init.d/slt.apache restart

Note: These changes are not part of the Airlock configuration backup. So please backup this configuration seperately.

Airlock Vulnerability Status:

Airlock vulnerable, see resolution

Back-end Vulnerability Status:

No action required

Reference:

Main menu