Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Three days ago, KingCope released a simple Perl script to DoS Apache, aptly named Apache Killer.

This script launches about 50 threads to request Partial Content from the server with optional GZIP encoding. This either will consume too much memory that the OS has to kill all other processes, or too much CPU that the server is brough to its knee.

Apache Foundation has not yet released a patch.

What is the best way to combat this?

share|improve this question
    
For people unfamiliar with the script it is available here - exploit-db.com/exploits/17696 –  Mark Davidson Aug 23 '11 at 10:28
add comment

4 Answers

up vote 7 down vote accepted

Five workarounds are discussed on the Apache mailing list. Go have a read for detail on each one:

1) Use SetEnvIf or mod_rewrite to detect a large number of ranges and then either ignore the Range: header or reject the request.

2) Limit the size of the request field to a few hundred bytes.

3) Use mod_headers to completely dis-allow the use of Range headers:

4) Deploy a Range header count module as a temporary stopgap measure:

5) Apply any of the current patches under discussion

share|improve this answer
    
    
Thanks, Rory. I disabled Range header initially. Luckily, it turns out to be a right move. Now is to wait for official patch. –  Nam Nguyen Aug 25 '11 at 12:19
    
@Nam - Apache v2.2.20 fixes it. Available now. –  Rory Alsop Aug 31 '11 at 12:54
add comment

By reading the script provided by Mark Davidson, the obvious temporary solution would be to disable apache's partial functionality if not needed.

This problem seem to be an old one, which have been "solved" by disabling the partial content requests. Here are two patches for previous versions of apache.

Apache 1.3.36

Apache 2.0.58

I downloaded the current apache source for debian squeezy to check for traces of this patch. Unfortunately, it seems like this is not implemented.

I'm not familiar with the source code for apache2, so I will not try to write a patch for it. This can be an exercise for the reader :)

share|improve this answer
add comment

http://www.guerilla-ciso.com/archives/2049 has an excellent analysis on DoS through resource thread exhaustion, as well as some thoughts on countermeasures including:

  • Know how to detect it.
  • Disable POST as a method if you don’t need it.
  • Set a low connection timeout

Have a read - good article.

share|improve this answer
    
Slow DoS is NOT the case of Apache Killer. Slow DoS affects Apache alone while the script mentioned could potentially kill all processes in the system. Besides, who does not need POST? –  Nam Nguyen Aug 24 '11 at 0:24
    
Hi @Nam - I know it isn't the same thing but a number of symptoms and countermeasures are still useful which is why I thought I'd post it. The 3 examples I gave are from the article's longer list, and yes, there are a lot of websites which do not use GET or POST:-) –  Rory Alsop Aug 24 '11 at 7:36
add comment

A bit late to the game here, but a WAF (web application firewall) would most likely also be a useful mitigation.
Even if it is not aware of this attack out of the box, any modern WAF should easily support blocking those types of requests even before they hit the webserver.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.