On 19 September 2011 09:51, Mattieu Baptiste <mattie...@gmail.com> wrote: > The apache foundation has adjusted the security advisory and Apache 1.3 isn't vulnerable. > > https://httpd.apache.org/security/CVE-2011-3192.txt
Yes, fair enough, BUT that same advisory says *in its Apache 1.3 section*: > However as explained in the background section in more detail - > this attack does cause a significant and possibly unexpected load. > You are advised to review your configuration in that light. and the Lee's original problem appears to be the result of an unexpected load. ---- b+ I've got loads (I've got loads... ...of three-five error codes, error, error codes) Loads, loads (loads), then three-five error codes, (error) error codes (codes) You thought I was just running -CURRENT or 4 point 9? I'm old skool, GETs served by Apach(e), mine It's the abominable dae-mon Older H-T-T-P-D, man "Stable rig for me, man" Two-oh-ohs, four-oh-fours; I send small PCs and gate(way)s HTML source One-five-oh max_clients on four point three: Scratching heads, starting threads, and you answer me So control your PoC tool and keep your boxes on And I'll finish this up by upgrading soon. Four point three box, three five error code, my server VH just overloads... b+ ---- PS: Figuring out how the Apache Foundation's declaration of non-vulnerability squares with their declaration of this performance impact is left as an exercise for the reader. PPS: Try to avoid a stack overflow via item 0) in the advisory's "Mitigation" section. Also, don't try to find "option '3'"...
