Forum Discussion

madi_56757's avatar
madi_56757
Icon for Nimbostratus rankNimbostratus
Aug 25, 2011

Apache Killer

hello all,     I need help for following rule   We need an irule to avoid an exploit on Apache       Apache syntax       RewriteEngine On   RewriteCond %{REQUEST_METHOD}...
application delivery
dev
devops
iRules
madi_56757's avatar
madi_56757
Icon for Nimbostratus rankNimbostratus
Aug 30, 2011

hi,

 

concerning the newest rule

 

 

 

when HTTP_REQUEST

 

{ HTTP::header remove Request-Range

 

if { [HTTP::header exists "Range"] and ([HTTP::header "Range"] matches_regex {(,.*?){40,}}) }

 

{ log local0. " Range attack CVE-2011-3192 detected from [IP::client_addr] to [HTTP::host]. [llength [split [HTTP::header "Range"], ","]] ranges requested." drop return } }

 

 

 

I got following error

 

Operation not supported (line 1) invoked from within "HTTP::header remove Request-Range"

 

 

we are using a version of 9.4.7

 

interestingly it is possible to apply the rule and if we are testing it with a range more then 40 it works!

 

Range attack CVE-2011-3192 detected from XXX. 1302 ranges requested.

 

 

any ideas

 

 

thanks for any statments

 

 

madi