Forum Discussion
Chris_H_33818
Nimbostratus
NimbostratusMS15-034
MS15-034 is a critical issue which we are looking at patching but we would like to apply an irule to filter for any exploit for our customers who haven't patched.
There is no exploit yet but it'...
DEJNimbostratus
NimbostratusHello,
The below is a recent article on this issue. It does not drop the request, it removes the Range header.
Name: stop_range_CVE-2015-1635
Description: This iRule will remove the Range header when detecting large ranges in it.
when HTTP_REQUEST {
remove Range requests for CVE-2015-1635 if the request uses large ranges
if { ([HTTP::header exists "Range"]) and ([HTTP::header "Range"] matches_regex {bytes\s*=.*([0-9]){10,}.*})}
{
HTTP::header remove Range
}
}
