|
Proeve -> RE: UN-F*N-BELIEVABLE (5/11/2006 5:09:48 PM)
|
added info: HTTP Apache Redundant Slashes DoS Severity: Medium This attack could pose a moderate security threat. It does not require immediate action. Description This signature detects requests with excessive slash marks (/). Additional Information On versions of Apache prior to 1.2.5, the overhead involved in removing redundant slashes grows exponentially in relation to the number of slashes -- O(n^2). You would not have to strip a single slash, but if two slashes appeared together, you would have to strip one of them. If there were three, you would remove two, but it would take twice as long. If there were eleven, you would have to remove ten, and it would take 1024 times as long. If an attacker sends enough requests with redundant slashes, the attacker could keep all Apache processes busy removing redundant slashes and this would effectively halt system performance and Web service. Affected: Apache Software Foundation Apache 0.8.11, 0.8.14, 1.0, 1.0.2, 1.0.3, 1.0.5, 1.1, 1.1.1, 1.2 Response Upgrade to the newest version of Apache. Possible False Positives There are no known false positives associated with this signature. Additional References
|
|
|
|