Home / server / Questions / 304859
Accepted
maff
Asked: 2011-08-26 03:44:01 +0800 CST

Apache - disable range requests - disadvantages?

  • 772

As there is a working exploit against Apache's byte range implementation (CVE-2011-3192, see here), I'd like to disable it until official patches are shipped with my distros (Debian, Ubuntu). The sites are all "normal" websites without big downloads. Are there any disadvantages in disabling the feature besides downloads that can't be resumed?

PS.: I'm disabling the feature by enabling mod_headers and unsetting the range header using the following line:

RequestHeader unset Range
exploit apache-2.2 security http-headers

1 Answers

  1. Best Answer

    Some applications that make requests to sites directly like to use ranges - I believe Adobe Reader is a good example.

    You can grep through your Apache logs looking for 206 partial response codes to see if anyone's actually using ranges for your site.

    For a workaround for this exploit, I'd say use the one recommended by Apache, which simply blocks ranges when there's more than 5 sets requested - which should leave any normal range requests unaffected, but block malicious ones:

    SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range
    • 7