Forum Discussion
Ido_Breger_3805
Aug 31, 2011Historic F5 Account
Latest Apache range headers DOS vulnerability signature suggestion
Hi ,
You probably heard about this latest Apace DOS vulnerability.
http://www.kb.cert.org/vuls/id/405811
Here is a suggestion to add 2 signatures that will block such attack (base...
BT_90520
Nimbostratus
Sep 21, 2011This is another good F5 article on several options to prevent this attack using BIG-IP solutions
http://devcentral.f5.com/weblogs/macvittie/archive/2011/08/26/f5-friday-zero-day-apache-exploit-zero-problem.aspx
So for more than 5 ranges requested, would I say the suggested (extracted from article) below is also fine, same as Option (1) from Ido except just need to change to {5} to {5,} ?
>> headercontent:"Range"; nocase; pcre:"/Range:[\t ]*bytes=(([0-9\- ])+,){5,}/Hi";
By the way, just curious why the need for Option (2) ?
Pardon me as I am new to iRule syntax. Thanks in advance.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects