Grave apache dos possible through byterange requests

2011-08-24 Thread Dirk Hartmann
Hi, it is possible to dos a actual squeeze-apache2 with easy to forge rage-requests: http://lists.grok.org.uk/pipermail/full-disclosure/2011-August/082299.html Apache-devs are working on a solution: http://www.gossamer-threads.com/lists/apache/dev/401638 But because the situation seems

Re: Grave apache dos possible through byterange requests

2011-08-24 Thread Carlos Alberto Lopez Perez
On 24/08/11 08:53, Dirk Hartmann wrote: Hi, it is possible to dos a actual squeeze-apache2 with easy to forge rage-requests: http://lists.grok.org.uk/pipermail/full-disclosure/2011-August/082299.html Apache-devs are working on a solution:

Re: Grave apache dos possible through byterange requests

2011-08-24 Thread Andrea Zwirner
2011/8/24 Carlos Alberto Lopez Perez clo...@igalia.com On 24/08/11 08:53, Dirk Hartmann wrote: Hi, it is possible to dos a actual squeeze-apache2 with easy to forge rage-requests: http://lists.grok.org.uk/pipermail/full-disclosure/2011-August/082299.html Apache-devs are working

Re: Grave apache dos possible through byterange requests

2011-08-24 Thread Carlos Alberto Lopez Perez
On 24/08/11 12:45, Andrea Zwirner wrote: 2011/8/24 Carlos Alberto Lopez Perez clo...@igalia.com On 24/08/11 08:53, Dirk Hartmann wrote: Hi, it is possible to dos a actual squeeze-apache2 with easy to forge rage-requests:

Re: Grave apache dos possible through byterange requests

2011-08-24 Thread Andrew McGlashan
Hi, Carlos Alberto Lopez Perez wrote: You can use the following redirect as a temporally workaround: # a2enmod rewrite RewriteEngine On RewriteCond %{HTTP:Range} bytes=0-.* [NC] RewriteRule .? http://%{SERVER_NAME}/ [R=302,L] Would that work for all websites of a Debian server if placed

Re: Grave apache dos possible through byterange requests

2011-08-24 Thread Carlos Alberto Lopez Perez
On 24/08/11 12:13, Carlos Alberto Lopez Perez wrote: You can use the following redirect as a temporally workaround: # a2enmod rewrite RewriteEngine On RewriteCond %{HTTP:Range} bytes=0-.* [NC] RewriteRule .? http://%{SERVER_NAME}/ [R=302,L] Sorry, the above redirect is wrong. It won't

Re: Grave apache dos possible through byterange requests

2011-08-24 Thread Carlos Alberto Lopez Perez
On 24/08/11 14:12, Andrew McGlashan wrote: Would that work for all websites of a Debian server if placed into a file located in /etc/apache2/conf.d ? Will other rewrites will be fine in the normal conf files for each website? Thanks It should not mess with another redirects that you