Forum Discussion

madi_56757's avatar
madi_56757
Icon for Nimbostratus rankNimbostratus
Aug 25, 2011

Apache Killer

hello all,     I need help for following rule   We need an irule to avoid an exploit on Apache       Apache syntax       RewriteEngine On   RewriteCond %{REQUEST_METHOD}...
application delivery
dev
devops
iRules
dlg_23340's avatar
dlg_23340
Icon for Cirrus rankCirrus
Aug 26, 2011
After another announcement from the apache folks and little help from smp offline, we have this: 

when HTTP_REQUEST {
  HTTP::header remove Request-Range
  if { [HTTP::header exists "Range"] and ([HTTP::header "Range"] matches_regex {(,.*?){40,}}) } {
    log local0. " Range attack CVE-2011-3192 detected from [IP::client_addr].  [llength [split [HTTP::header "Range"], ","]] ranges requested."
    drop
    return
  }
}