Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Three days ago, KingCope released a simple Perl script to DoS Apache, aptly named Apache Killer.
This script launches about 50 threads to request Partial Content from the server with optional GZIP encoding. This either will consume too much memory that the OS has to kill all other processes, or too much CPU that the server is brough to its knee.
Apache Foundation has not yet released a patch.
What is the best way to combat this?
Five workarounds are discussed on the Apache mailing list. Go have a read for detail on each one:
1) Use SetEnvIf or mod_rewrite to detect a large number of ranges and then either ignore the Range: header or reject the request.
2) Limit the size of the request field to a few hundred bytes.
3) Use mod_headers to completely dis-allow the use of Range headers:
4) Deploy a Range header count module as a temporary stopgap measure:
5) Apply any of the current patches under discussion
By reading the script provided by Mark Davidson, the obvious temporary solution would be to disable apache's partial functionality if not needed.
This problem seem to be an old one, which have been "solved" by disabling the partial content requests. Here are two patches for previous versions of apache.
I downloaded the current apache source for debian squeezy to check for traces of this patch. Unfortunately, it seems like this is not implemented.
I'm not familiar with the source code for apache2, so I will not try to write a patch for it. This can be an exercise for the reader :)
http://www.guerilla-ciso.com/archives/2049 has an excellent analysis on DoS through resource thread exhaustion, as well as some thoughts on countermeasures including:
Have a read - good article.
A bit late to the game here, but a WAF (web application firewall) would most likely also be a useful mitigation.
Even if it is not aware of this attack out of the box, any modern WAF should easily support blocking those types of requests even before they hit the webserver.
