Possible To Block HTTP/1.0 Requests?

[pwebber]

Can't seem to find a way to do it. I don't see a built-in signature, and was going to make a custom one, but the patern match context doesn't seem to cover the HTTP version for some odd reason. Maybe I'm missing something?

[murphyj]

Can you put in a screen shot of the packet capture you want to make it based off of?

[claudec]

Although the custom signature document indicates the "http-req-headers" context excludes the ablity to match on the method/path/version/host info, I have found that you can at least match on the method and version info using this context.

I haven't tried to match path/host info, however, as there are specific contexts available for those headers.

The attached vulnerability sig XML looks for v1.1 in a GET method, it would be easy enough to modify it to look for 1.0.

-C

<vulnerability-threat version="7.1.0">
  <entry name="41002">
    <signature>
      <standard>
        <entry name="sig-http-ver">
          <and-condition>
            <entry name="And Condition 1">
              <or-condition>
                <entry name="Or Condition 1">
                  <operator>
                    <pattern-match>
                      <qualifier>
                        <entry name="http-method">
                          <value>GET</value>
                        </entry>
                      </qualifier>
                      <pattern>\x48 54 54 50 2f 31 2e 31\x</pattern>
                      <context>http-req-headers</context>
                      <negate>no</negate>
                    </pattern-match>
                  </operator>
                </entry>
              </or-condition>
            </entry>
          </and-condition>
          <order-free>no</order-free>
          <scope>protocol-data-unit</scope>
          <comment>looks for http version 1.1 in header</comment>
        </entry>
      </standard>
    </signature>
    <default-action>
      <alert/>
    </default-action>
    <threatname>http-header-get-v1-1</threatname>
    <severity>informational</severity>
    <direction>client2server</direction>
    <comment>http 1.1</comment>
    <affected-host>
      <client>yes</client>
    </affected-host>
  </entry>
</vulnerability-threat>

[pwebber]

Thanks! I'll give this a try!