Subject: Problem in mod_ssl 2.8.10 + Apache 1.3.26/WIn32 ?

From: Sergey Strakhov <[email-masked]>
Date: Tue, 15 Oct 2002 11:13:35 -0400

Hello,

We are experiencing problems with our Win32 Apache 1.3.26 with mod_ssl
2.8.10 + openssl 0.9.6b running on Windows 2000.
It is a sort of DoS attacks that make our web site totally inaccessible.

One of those attacks was captured with Ethereal. The dump is attached.

As you can see, the attack is accomplished through both HTTP (80) and
HTTPS (443) ports.
First, the connection is opened to the HTTP port, then it is opened to
the HTTPS port.
Then a malformed HTTP/1.1 GET request (with no Host: header) is sent to
the HTTP port.
Then both connections are closed without waiting for the response from
the web server.
As a result, the web site stops responding on both HTTP and HTTPS ports.

The error log usually contains records like:

[..time..] [error] [client ..] client sent HTTP/1.1 request without
hostname (see RFC2616 section 14.23): /
[..time..] [error] Server ran out of threads to serve requests. Consider
raising the ThreadsPerChild setting

Is this problem related to mod_ssl anyhow?
Will an upgrade to Apache 1.3.27 + mod_ssl 2.8.11 + openssl 0.9.6g solve
the problem?

Regards

---

From: "Nadav Har'El" <[email-masked]>
Date: Tue, 15 Oct 2002 17:27:50 +0200

>From your description it sounds like this is the worm described in:

http://www.cert.org/advisories/CA-2002-27.html

However, to the best of my knowledge, this worm cannot infect your Windows -
it will only kill your sever.

> Will an upgrade to Apache 1.3.27 + mod_ssl 2.8.11 + openssl 0.9.6g solve

Yes, I think it will.

-- 
Nadav Har'El                        |     Tuesday, Oct 15 2002, 9 Heshvan 5763
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |Tact is the art of making a point without
http://nadav.harel.org.il           |making an enemy.
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Sergey Strakhov <[email-masked]>
Date: Tue, 29 Oct 2002 12:25:47 -0500

> it will only kill your sever.

Not exactly... It looks more like a Cross-Site-Scripting bug...

> > Will an upgrade to Apache 1.3.27 + mod_ssl 2.8.11 + openssl 0.9.6g solve

Version 2.8.11 did not help. But 2.8.12 probably should.