Mailing List Archive: Re: DoS with mod

Mailing List Archive: Apache: Dev
Re: DoS with mod_deflate & range requests

Index | Next | Previous | View Flat

isoma at jellybaby

Aug 23, 2011, 7:00 AM

Views: 14565
Permalink

Re: DoS with mod_deflate & range requests [In reply to]

On Tue, Aug 23, 2011 at 02:15:16PM +0200, Lazy wrote:
> 2011/8/23 Stefan Fritsch <sf [at] sfritsch>:
> > http://seclists.org/fulldisclosure/2011/Aug/175
> >
> > I haven't looked into it so far. And I am not sure I will have time today.
> >
>
> it is sending HEAD requests with lots of ranges
> HEAD / HTTP/1.1
> Host: xxxx
> Range:bytes=0-,5-1,5-2,5-3,.....
…
> doeas Range in HEAD request have any sense at all ?

One /possible/ use is as an equivalent for a conditional GET, ie
GET / HTTP/1.1
Host: xxx
Range: bytes=1024-
If-Range: "foo"

…to which the correct response should I think be either 200 or 206 depending
on whether the document is modified.

But it's a pretty odd case. I can't imagine any published client or proxy
that would make such a request. It would in any case be acceptable to
return a 200 response instead; RFC 2616 states that "A server MAY ignore
the Range header"

Tim Bannister

Subject	User	Time
DoS with mod_deflate & range requests	sf at sfritsch	Aug 23, 2011, 4:08 AM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 23, 2011, 5:11 AM
Re: DoS with mod_deflate & range requests	lazy404 at gmail	Aug 23, 2011, 5:15 AM
Re: DoS with mod_deflate & range requests	lazy404 at gmail	Aug 23, 2011, 6:56 AM
Re: DoS with mod_deflate & range requests	isoma at jellybaby	Aug 23, 2011, 7:00 AM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 23, 2011, 11:18 AM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 23, 2011, 11:49 AM
Re: DoS with mod_deflate & range requests	mohameddawaina at gmail	Aug 23, 2011, 11:52 AM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 23, 2011, 12:32 PM
Re: DoS with mod_deflate & range requests	ames.greg at gmail	Aug 23, 2011, 2:00 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 23, 2011, 2:34 PM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 23, 2011, 3:28 PM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 24, 2011, 1:05 AM
Re: DoS with mod_deflate & range requests	fielding at gbiv	Aug 23, 2011, 6:34 PM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 23, 2011, 11:38 PM
Re: DoS with mod_deflate & range requests	isoma at jellybaby	Aug 24, 2011, 8:35 AM
Re: DoS with mod_deflate & range requests	Dirk-Willem.van.Gulik at bbc	Aug 24, 2011, 8:46 AM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 24, 2011, 8:55 AM
Re: DoS with mod_deflate & range requests	fielding at gbiv	Aug 24, 2011, 1:56 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 2:12 PM
Re: DoS with mod_deflate & range requests	fielding at gbiv	Aug 24, 2011, 2:54 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 4:39 PM
Re: DoS with mod_deflate & range requests	fielding at gbiv	Aug 24, 2011, 4:43 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 4:50 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 6:01 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 5:59 PM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 24, 2011, 11:21 PM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 24, 2011, 11:56 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 8:41 AM
Re: DoS with mod_deflate & range requests	h.reindl at thelounge	Aug 23, 2011, 3:12 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 8:48 AM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 24, 2011, 9:02 AM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 9:01 AM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 24, 2011, 9:05 AM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 9:22 AM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 9:42 AM
Re: DoS with mod_deflate & range requests	ames.greg at gmail	Aug 24, 2011, 12:10 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 12:34 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 1:12 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 2:01 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 9:33 AM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 24, 2011, 9:47 AM
Re: DoS with mod_deflate & range requests	isoma at jellybaby	Aug 24, 2011, 11:43 AM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 12:13 PM
Re: DoS with mod_deflate & range requests	isoma at jellybaby	Aug 24, 2011, 1:37 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 12:19 PM
Re: DoS with mod_deflate & range requests	ames.greg at gmail	Aug 24, 2011, 1:39 PM
Re: DoS with mod_deflate & range requests	dirkx at webweaving	Aug 24, 2011, 1:45 PM
Re: DoS with mod_deflate & range requests	fielding at gbiv	Aug 24, 2011, 1:58 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 2:00 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 2:08 PM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 24, 2011, 2:04 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 2:06 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 2:19 PM
Re: DoS with mod_deflate & range requests	ames.greg at gmail	Aug 24, 2011, 2:32 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 25, 2011, 4:41 AM

Index | Next | Previous | View Flat

Interested in having your list archived? Contact Gossamer Threads