On Wed, Aug 24, 2011 at 10:56 AM, Dirk-Willem van Gulik < [email protected]> wrote:
+1 with Eric's edits. specifically,
>
> 1) Use mod_rewrite to limit the number of ranges:
>
Option 1 doesn't use mod_rewrite.
Option 1:
> # drop Range header when more than 5 ranges.
> # CVE-2011-3192
> SetEnvIf Range (,.*?){5,} bad-range=1
> RequestHeader unset Range env=bad-range
>
> # optional logging.
> CustomLog logs/range-CVE-2011-3192.log common env=bad-range
>
Greg
