Full Disclosure mailing list archives

Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192)

From: Andrew Farmer <andfarm () gmail com>
Date: Mon, 29 Aug 2011 16:39:59 -0700

On 2011-08-26, at 08:12, Nikolay Kichukov wrote:

Hi,
This one works like charm on my debian stable

LimitRequestFieldSize 200

in the apache2.conf as global directive for all vhosts.


Be cautious about applying this mitigation -- it *will* break applications which use large cookies. In particular, the 
cookies generated by Google Analytics are often over 200 bytes long alone.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Dirk-Willem van Gulik (Aug 25)
- Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Anestis Bechtsoudis (Aug 26)
- <Possible follow-ups>
- Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Dirk-Willem van Gulik (Aug 26)
  - Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Carlos Alberto Lopez Perez (Aug 26)
    - Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) bodik (Aug 26)
    - Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) bodik (Aug 26)
    - Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Nikolay Kichukov (Aug 27)
    - Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Andrew Farmer (Aug 29)
    - Re: Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x (CVE-2011-3192) Dirk-Willem van Gulik (Aug 26)