Fix For Apache DoS Bug In the Pipes 49
Trailrunner7 writes with the report that "The Apache Software Foundation plans to have a fix available in the next day or so [Note: that means today, now. --Ed.] for the denial-of-service problem in Apache that was publicized late last week. The bug, which in some forms has been under discussion for more than four years, involves the way that the Web server handles certain overlapping range headers. The vulnerability is a denial-of-service bug, but it is considered serious because a remote attacker can essentially take a targeted server offline with little effort and resources. The Apache Software Foundation, which maintains the popular open-source Web server, updated its advisory on the vulnerability, saying that it expects to have a full fix available for the vulnerability within the next 24 hours."
Apache has an excellent security record. (Score:4, Interesting)
The one thing that I've found really astounding about this whole ordeal is how despicably some members of the open source community have acted towards Apache and its developers. The pure hatred they have spewed is absurd. For such a large and widely-used piece of software, Apache has a superb record of being secure and reliable. The ridicule it has received lately, especially from the open source community, is disheartening.
Somewhat surprisingly, this criticism has been coming from PHP, Ruby and JavaScript programmers. Many of these people likely don't even know C. Yet they still feel it necessary to belittle the Apache developers for making what is actually a very obscure mistake many years back. Of course, these people delivering the criticism won't admit that their own software is far buggier and insecure than Apache. The developers of PHP would never break a critical security-related function like crypt(), right?
Offensive (Score:2, Interesting)
From the article:
"This problem is so obvious, my grandmother could identify it."
As a 49 yo grandmother, C programmer of 20+ years, and a feminist this offends me. They wouldn't have said grandfather.
Re: (Score:1)
Re: (Score:2)
Somewhat surprisingly, this criticism has been coming from PHP, Ruby and JavaScript programmers. Many of these people likely don't even know C. Yet they still feel it necessary to belittle the Apache developers for making what is actually a very obscure mistake many years back
Let me ask, is mixing free and non-free software acceptable to you? The FLOSS community promotes using open source above all else, for the sake of more people using open source. If "shut up if you can't program" was their motto, its user base should be a tiny fraction of what it is. Unless you think people like being told to "shut up and use it anyway."
You wouldn't DARE tell me, not-a-programmer, use open source "just because", and do not complain about it, in anything short of suicidal fantasies. UNIX
Re: (Score:2)
Grow up folks, buy software when it works.
You let me know how that works out for you.
In particular, I'd love to know what browser you are using to produce your rant, cause I'm not aware of any browser implementation available today that "works" in the manner you suggest they should.
In the meantime, I'll stick with what "reasonably works, and coincidentally works better than the commercial alternatives". You know, like, Apache.
Re: (Score:2)
Your entire post is basically that you don't like seeing Apache criticized on message boards. So what? You even end with a pointless remark about programmers you assume don't know C, as if that has anything to do with anything. Apache brought criticism onto themselves. The bug is more than four-and-a-half years old.
Re: (Score:2)
Apache brought criticism onto themselves. The bug is more than four-and-a-half years old.
This memory allocation bug is distinct from Zalewski's bandwidth multiplying bug.
Indeed, both stem from "silly" Range handling, but they are still different bugs. I.e., the bug is not 4+ years old.
Re: (Score:1)
Apache is the #1 server on the Internet. Of course it's the #1 attacked too. Duh! Go back under your bridge, troll.
Not just an Apache bug (Score:5, Insightful)
It's a protocol bug. Any server that implements the protocol to the letter is vulnerable. And it's not just about overlapping ranges. If the server can send a ten megabyte file, an attacker can ask it for ten million of one-byte ranges. The processing overhead will bring most servers to their knees. If the server can compress the output, an attacker can ask for ten million of compressed one-byte ranges. An attempt to execute such a request will kill just about anything. The protocol should have limited the number of ranges per request to, say, 10.
Re: (Score:2)
Re: (Score:3)
If Apache doesn't return an error code it will have to keep the connection open, and you're back at the "consuming so many resources it's denying legitimate traffic" part of the denial of service.
Re: (Score:2)
If Apache doesn't return an error code it will have to keep the connection open
What part of the HTTP spec bans issuing a 400 Bad Request when something looks like a DoS? And is there a reason why Apache can't hand off thousands of connections to a separate, lightweight "penalty box" server process?
Re: (Score:2)
How about ten thousand (Score:2)
Re: (Score:3)
65535 connections for TCP (minus a few) per server...
To be pedantic, that's 65535 per (client_ip,port) pair...
Re: (Score:3)
It all depends how you implement it but yes, it would have been wiser to let the server discard some of the ranges if needed and ask the client to do another request later.
Re: (Score:3)
The protocol does not require the server to answer at all. The server can just send an error response if it gets too many ranges in a request. The protocol designers cannot know how many resources a given server has available. The most they could do was add a specific error response for "too many ranges, resubmit as individual requests".
Re: (Score:2)
How did you test? nginx does honor Range requests. The Apache killer will report that nginx not vulnerable, so what, it misreports PHP-based Apache installations too. However, this attack can be performed in more than one way. Maybe you should know that nginx maintainers have released a patch today. I wonder why.
I have read that IIS is vulnerable to this too, not sure if this is true, I have no IIS installations that I can check.
I'm not sure what Cherokee does so I can't comment here.
Re: (Score:2)
Apache's implementation problems go beyond the protocol specs. The sample attack codes includes invalid ranges in the request (E.g start at 5, end at 0). So the protocol specs aren't the only thing to blame. Also, the fact that apache is the only server to be crippled by this issue is a strong data point against putting all blame on the protocol.
Re: (Score:1)
Apache has its share of its own unique bugs, that's true.
I hear... (Score:1)
the sound of millions lazy sysadmins compaining!
Comment removed (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Request-Range? I'm not familiar with that request-header field. Searching now, I can't find it in RFC 2616 [ietf.org] either. Could you point to where you heard about it?
Re: (Score:2)
According to http://marc.info/?l=apache-httpd-dev&m=131418828705324&w=2 [marc.info] the correct syntax is:
RequestHeader unset Range
I wonder if... (Score:1)
Re: (Score:2)
Pipes are 1/8 of a tube.
Re: (Score:2)
Re: (Score:1)
Yeah, once this hits our change control procedures - gets through an internal review or three, jumps through our unreliable release process (after getting munged by several git merge conflicts) it'll fly right on out to our 2k machines RSN. Oh yeah, did I mention how we wouldn't be bothering to test to make sure it doesn't cause any problems in QA?