Just five days ago, a script appeared on the Full Disclosure mailing list that, according to the author, kills Apache from the very oldest versions to the very newest.
And it really works. The killapache.pl script launches, in several dozen threads, a simple request:
HEAD / HTTP/1.1
Host: www.example.com
Range: bytes=0-,5-0,5-1,5-2,5-3,5-4,<...>,5-1299,5-1300
Accept-Encoding: gzip
Connection: close
In response to such a request, Apache, in order to calculate Content-Length, assembles in memory a long response made up of overlapping chunks of the requested file, which can take up, and does take up, a significant amount of memory. In this case Apache's memory consumption starts growing sharply, as shown on the graph at the beginning, which, with a suitably small number of requests, leads to a DoS even on decent servers.
Solution:
1) As the authors state, if you have a caching nginx in front of Apache, nothing bad will happen.
2) If your Apache faces outward by itself, directly and alone.
Run the command:
$ sudo a2enmod headers
After that, go into the Apache config and add the following lines in a convenient place in the global configuration:
RequestHeader unset Range
RequestHeader unset Request-Range
That is, in the place where directives common to all virtual hosts are defined. Here's an example of a piece of such a file:
...
#
# The following directives define some format nicknames for use with
# a CustomLog directive (see below).
# If you are behind a reverse proxy, you might want to change %h into %{X-Forwarded-For}i
#
LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
#
# Define an access log for VirtualHosts that don't define their own logfile
CustomLog /var/log/apache2/other_vhosts_access.log vhost_combined
# Disabling hacked headers (which can be used to DoS the Apache)
RequestHeader unset Range
RequestHeader unset Request-Range
...
After that, restart Apache.
Alternatively, if you need these headers, there's a workaround via the Rewrite Engine or other mod_headers methods
Applies to: Apache2, any versions up to and including 2.2.17
Comments