Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of covener@gmail.com designates
 209.85.218.45 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <7C3A95E6-D1B6-4E5A-9B52-922CD27C8370@webweaving.org>
References: <7C3A95E6-D1B6-4E5A-9B52-922CD27C8370@webweaving.org>
Date: Wed, 24 Aug 2011 15:40:21 -0400
Message-ID: 
 <CALK=YjOFDNK2ZnAz-kbb8UiFcuQK83SbFK5iTt9B105vY9oiDw@mail.gmail.com>
Subject: Re: Final draft / CVE-2011-3192
From: Eric Covener <covener@gmail.com>
To: dev@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

I'm seeing Apache 2.0 doesn't accept our RequestHeader syntax due to a
defect, it misinterprets it as a value and fails startup.

If we have the opportunity to amend, I think we need to suggest the
rewrite flavor for Apache 2.0 and earlier, not just 1.3 and earlier.

Also for 1.3, is our RE safe for non-PCRE? And should we reconsider
the "5" for something more liberal?

> =A0 Option 1: (Apache 2.0 and 2.2)
>
> =A0 =A0 =A0 =A0 =A0# drop Range header when more than 5 ranges.
> =A0 =A0 =A0 =A0 =A0# CVE-2011-3192
> =A0 =A0 =A0 =A0 =A0SetEnvIf Range (,.*?){5,} bad-range=3D1
> =A0 =A0 =A0 =A0 =A0RequestHeader unset Range env=3Dbad-range
>
> =A0 =A0 =A0 =A0 =A0# optional logging.
> =A0 =A0 =A0 =A0 =A0CustomLog logs/range-CVE-2011-3192.log common env=3Dba=
d-range
>
> =A0 Option 2: (Also for Apache 1.3)
>
> =A0 =A0 =A0 =A0 =A0# Reject request when more than 5 ranges in the Range:=
 header.
> =A0 =A0 =A0 =A0 =A0# CVE-2011-3192
> =A0 =A0 =A0 =A0 =A0#
> =A0 =A0 =A0 =A0 =A0RewriteEngine on
> =A0 =A0 =A0 =A0 =A0RewriteCond %{HTTP:range} !(^bytes=3D[^,]+(,[^,]+){0,4=
}$|^$)
> =A0 =A0 =A0 =A0 =A0RewriteRule .* - [F]