hi,
concerning the newest rule
when HTTP_REQUEST
{ HTTP::header remove Request-Range
if { [HTTP::header exists "Range"] and ([HTTP::header "Range"] matches_regex {(,.*?){40,}}) }
{ log local0. " Range attack CVE-2011-3192 detected from [IP::client_addr] to [HTTP::host]. [llength [split [HTTP::header "Range"], ","]] ranges requested." drop return } }
I got following error
Operation not supported (line 1) invoked from within "HTTP::header remove Request-Range"
we are using a version of 9.4.7
interestingly it is possible to apply the rule and if we are testing it with a range more then 40 it works!
Range attack CVE-2011-3192 detected from XXX. 1302 ranges requested.
any ideas
thanks for any statments
madi