RSA Validation Manager 3.1
Security scan shows a possible denial of service vulnerability
CVE-2011-3192
The version of Apache HTTP Server running on the remote host is affected by a denial of service vulnerability. Making a series of HTTP requests with overlapping ranges in the Range or Request-Range request headers can result in memory and CPU exhaustion. A remote, unauthenticated attacker could exploit this to make the system unresponsive. Exploit code is publicly available and attacks have reportedly been observed in the wild.
We have used the test script provided in the link http://seclists.org/fulldisclosure/2011/Aug/175 to test this vulnerability. We ran with 50 child processes and memory went up to 200 MB and it's not coming down also. But there is no Apache crash observed with this test result.
The vulnerability is not dependent on the presence or absence of the module mod_deflate. This is clear from the apache mail archive link. RVM does not use the module mod_deflate.
We have tested the mitigation options provided by IBM and as well as apache.
Mitigations:
=========
1) Use SetEnvIf or mod_rewrite to detect a large number of ranges and then either ignore the Range: header or reject the request.
We recommed to use mod_rewrite option to reject request if range exceeds 'n' number of bytes. We tested with SetEnvif and found that it is not restricting the ranges. The number of bytes to restrict is varying from IBM and apache. Any specific value can be given to restrict the range header, still it would be better to follow the apache way. Apache suggested a number of 5 bytes to restrict.
steps to configure:
a) In the httpd.conf, add the following lines in the virtual host section.
- Reject request when more than 5 ranges in the Range: header.
- CVE-2011-3192
#
RewriteEngine on
RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$)
RewriteRule .* - [F]
b) In the httpd.conf enable the module "rewrite_module" to support the above directive.
To do this find the line,
#LoadModule rewrite_module modules/mod_rewrite.so
and remove # from the line.
We have tested with the above workaround. In case of exceeding its range header apache returns forbidden error (403).
Related Articles
Apache vulnerability 'Apache HTTP Server mod_rewrite' from scan 45Number of Views Issue with RADIUS authentication in New PIN Mode and no RADIUS administration possible 42Number of Views 'Unsafe characters detected in URL parameters. Possible XSS attack.' accessing Dashboards in version 7.0.2+ of RSA Identit… 44Number of Views Unclear Error Message Possible for Application Protected by Fingerprint Only 32Number of Views KCA Apache web server showing security vulnerability with scan due patch level/version 46Number of Views
Trending Articles
Passwordless Authentication in Windows MFA Agent for Active Directory – Quick Setup Guide RSA Authentication Manager 8.9 Release Notes (January 2026) RSA Authentication Manager Upgrade Process RSA Authentication Manager 8.7 SP2 Setup and Configuration Guide An example of SSO using SAML and ADFS with RSA Identity Management and Governance 6.9.x