miscelanious

First of all, today is a very good friend's birthday, so: Happy Birthday, Maria!

There were some interesting news I read today. One of the was about Pakistan banning secure VPN connections. The reason is of course that it would be difficult if not impossible to monitor this kind of connections. I guess people from Pakistan are not allowed to have privacy, at least not over the internet. Maybe tomorrow they will ban the internet itself. All I have to say about this is that this year was not a very good one for the Arabian dictatorships. Think about Egipt, Libia, now I guess things are happening in Siria also. Usually nothing good comes from very strict laws. Except for China of course. They really made it work.

Another interesting topic: e women bought a laptop for the fabulous sum of 60 dollars. Big surprise, this laptop proved to be stolen. Since these days there are all kind of software that will help you locate you missing laptop, the laptop was found and recovered. In the meanwhile it happened that this woman's boyfriend was abroad. She then took some pictures of her naked and used the laptop to send them to the travelling boyfriend. Now she is requesting these pictures, because she says that they are her property, even tough they are located on a stolen property. I have no comment on this topic, but I just find the story quite funny.

This is it for today. Have a good one!

apache vulnerability

All versions of apache web server have a very serious vulnerability. Only a perl script that runs only one computer will crash any web server. This is described well enough here: http://seclists.org/fulldisclosure/2011/Aug/176

The script that crashes Apache is called killapache.pl and is all over the internet, for example http://pastebin.com/EYFUnFRz

Everyone out there having a webserver should protect it against this script. There are all kind of solutions on the web, I personally searched for one that would work on Centos. I created a file called fix-ddos.conf and placed it in /etc/httpd/conf.d. This file contains:


    SetEnvIf Range (,.*?){5,} bad-range=1
    RequestHeader unset Range

For Ubuntu it was enough to add to apache.conf the two lines:

     SetEnvIf Range (,.*?){5,} bad-range=1
     RequestHeader unset Range

There are some other proposed solutions, but I only tested successfully the two I mentioned. Other solutions and further information are available here: http://www.dslreports.com/forum/r26243047-Apache-1.x-2.x-Range-header-security-issue