Apache 全系爆拒绝服务漏洞 解决方案

  • 时间:
  • 浏览:1

  Apache 项目日前发布了一另有一个拒绝服务(DoS)漏洞警告,该漏洞可让攻击者轻松的让 Apache 软件拒绝服务,该漏洞影响 Apache 的所有版本。或者坊间前一天流传着前一天的攻击工具,该攻击可使 Apache Http Server 占用大多数的内存和 CPU,从而导致 无法出理 正常的请求。

  采用默认妙招安装的 Apache 非常容易受此攻击,或者目前还找不到 相应的补丁版本,预计在 48 小时内 Apache 会推出相应的补丁多多程序运行 。

以下出理 方案都里能临时使用,直到新的补丁出来:

1) Use SetEnvIf or mod_rewrite to detect a large number of ranges and then

either ignore the Range: header or reject the request.

Option 1: (Apache 2.0 and 2.2)

# Drop the Range header when more than 5 ranges.



# CVE-2011-3192

SetEnvIf Range (,.*?){5,} bad-range=1

RequestHeader unset Range env=bad-range

# optional logging.



CustomLog logs/range-CVE-2011-3192.log common env=bad-range

Option 2: (Also for Apache 1.3)

# Reject request when more than 5 ranges in the Range: header.



# CVE-2011-3192

#

RewriteEngine on

RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)

RewriteRule .* - [F]

The number 5 is arbitrary. Several 10's should not be an issue and may be



required for sites which for example serve PDFs to very high end eReaders

or use things such complex http based video streaming.

2) Limit the size of the request field to a few hundred bytes. Note that while



this keeps the offending Range header short - it may break other headers;

such as sizeable cookies or security fields.

LimitRequestFieldSize 3000

Note that as the attack evolves in the field you are likely to have



to further limit this and/or impose other LimitRequestFields limits.

See: http://httpd.apache.org/docs/2.2/mod/core.html#limitreque...

3) Use mod_headers to completely dis-allow the use of Range headers:

RequestHeader unset Range

Note that this may break certain clients - such as those used for



e-Readers and progressive/http-streaming video.

4) Deploy a Range header count module as a temporary stopgap measure:

http://people.apache.org/~dirkx/mod_rangecnt.c

Precompiled binaries for some platforms are available at:

http://people.apache.org/~dirkx/BINARIES.txt

5) Apply any of the current patches under discussion - such as:

http://mail-archives.apache.org/mod_mbox/httpd-dev/201108...

Tags: apache   apache漏洞   拒绝服务漏洞   apache补丁  
责任编辑:190