topic Re: Range header DoS vulnerability Apache HTTPD 1.3/2.x \(CVE-2011-3192\ in General Topics

Range header DoS vulnerability Apache HTTPD 1.3/2.x \(CVE-2011-3192\

kirvin1 — Thu, 25 Aug 2011 14:37:05 GMT

CVE-2011-3192 Was published yesterday. Are there any mitigation steps I can make in the PaloAlto until they release a vulnerability update?

http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/browser

Re: Range header DoS vulnerability Apache HTTPD 1.3/2.x \(CVE-2011-3192\

exclusive — Mon, 29 Aug 2011 10:23:31 GMT

Hello

If you chech this in Application & Theat Research Center:

https://live.paloaltonetworks.com/message/8747#8747

You can see that isn´t supported yet CVE-2011-3192

Regards

Re: Range header DoS vulnerability Apache HTTPD 1.3/2.x \(CVE-2011-3192\

fredallee — Mon, 29 Aug 2011 16:28:43 GMT

We are targeting to release a vulnerability signature to cover this tomorrow. In the mean time, here are some recommended mitigation steps that we have found:

http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3C20110824161640.122D387DD@minotaur.apache.org%3E

http://www.edwiget.name/2011/08/quick-fix-for-apache-cve-2011-3192/

Alfred