Alert: Apache DoS attack

[Michal Safranek]

Zdravim,
tak sem si rek, ze aspon neco postnu a treba me nekdo bude v tom 
'lokalnim bugtraqu' nasledovat :)

Typ utoku: DoS 

Popis utoku: Diky nekolikanasobnemu (10000 a vic) odeslani 'User-
agent:' headeru, Apache alokuje velke mnozstvi pameti (vetsinou 
veskerou :) ) 

Postizene verze: Testovano na Apache 1.2.X, 1.3.[01]

Priklad:
--begin--
[safranek na ns safranek]$ telnet 127.0.0.1 80
GET / HTTP/1.0
User-agent: Sioux
[ ... asi tak 10000 to samy ... :) ]
User-agent: Sioux

[safranek na ns safranek]$
-- end --

Exploit: N/A

Patch:
Original patch od Bena Laurie (clen Apache Group) se da najit v 
Bugtraqu, ale jelikoz mi na 1.3.1 nefungoval (*.rej), tak sem ho 
upravil a tady je:

begin 660 APACHE.PAT
M+2TM(&AT='!?<')O=&]C;VPN;VQD"5=E9"!*=6P@(#@@,3DZ-#<Z,#4@,3DY
M.`T**RLK(&AT='!?<')O=&]C;VPN8PE3870 na 075G("`X(#$U.C(Y.C(Y(#$Y
M.3 na -"D!`("TW,38L-B`K-S$V+#<@0$`-"B`@("`@:6YT(&QE;CL-"B`@("`@
M8VAA<B`J=F%L=64[#0H@("`@(&-H87(@9FEE;&1;34%87U-44DE.1U],14Y=
M.PT**R`@("!I;G0@;FAE861E<G,],#L-"B`-"B`@("`@+RH-"B`@("`@("H@
M4F5A9"!H96%D97(@;&EN97,@=6YT:6P@=V4 na 9V5T('1H92!E;7!T>2!S97!A
M<F%T;W(@;&EN92P na 82!R96%D(&5R<F]R+`T*0$`@+3<R-"PV("LW,C4L,3$@
M0$`-"B`@("`@=VAI;&4@*"AL96X@/2!G971L:6YE*&9I96QD+"!-05A?4U12
M24Y'7TQ%3BP na 8RT^8VQI96YT+"`Q*2D@/B`P*2![#0H@("`@("`@("!C:&%R
M("IC;W!Y(#T na 87!?<&%L;&]C*'(M/G!O;VPL(&QE;B`K(#$I.PT*("`@("`@
M("`@;65M8W!Y*&-O<'DL(&9I96QD+"!L96X@*R`Q*3L-"BL-"BL@("`@("`@
M(&EF*"LK;FAE861E<G,@/3T@,3`P*2![#0HK("`@("`@("`@("!R+3YS=&%T
M=7,@/2!(5%107T)!1%]215%515-4.PT**R`@("`@("`@("`@<F5T=7)N.PT*
M*R`@("`@("!]#0H@"0T*(`EI9B`H(2AV86QU92`]('-T<F-H<BAC;W!Y+"`G
M.B<I*2D@>R`@("`@+RH na 1FEN9"!T:&4 na 8V]L;VX@<V5P87)A=&]R("HO#0H@
M"2`@("`O*B!I9B!T:&5R92=S(&YO;F4L('1H:7,@<F5Q=65S="!I<R!S8W)E
)=V5D('5P+ na T*
 
end

Pokud mate nejakou pripominku, mailto: safra-mi na ddm.jhrnet.cz

M.
--
+-------------------------------------------------------------------------+
| Michal (Wayne-) Safranek, network administrator                         |
| safra-mi na ddm.jhrnet.cz || wayne- na jhrnet.cz                              |
| Motto: Windows ? Proc ne .... ale NE NA MEM PC !                        |
+-------------------------------------------------------------------------+