DoS attack on mod_ssl 2.8.12 ??

DoS attack on mod_ssl 2.8.12 ??

am 19.12.2002 17:03:44 von Sergey Strakhov

This is a multi-part message in MIME format.
--------------64192C76DD9A01B614C0BD74
Content-Type: text/plain; charset=koi8-r
Content-Transfer-Encoding: 7bit

Hello,

We are experiencing problems with our Win32 Apache 1.3.27 with mod_ssl
2.8.12 + openssl 0.9.6g running on Windows 2000.
It is a sort of DoS attack that makes our web site totally inaccessible.

One of those attacks was captured with Ethereal. The dump is attached.

As you can see, the attack is accomplished through both HTTP (80) and
HTTPS (443) ports.
First, the connection is opened to the HTTP port and a malformed
HTTP/1.1 GET request (with no Host: header) is sent to the HTTP port
(probably with an intention to produce a crash described in
http://www.cert.org/advisories/CA-2002-27.html or just to determine the
host's Server version). The server responds with "HTTP/1.1 400 Bad
request" and closes the connection. After that the attacker starts
opening connections to the HTTPS port. One of them is used to send SSLv2
Client Hello request. From this point the web server starts rejecting
all incoming connections and the web site stops responding on both HTTP
and HTTPS ports.

The error log usually contains records like:

[..time..] [error] [client ..] client sent HTTP/1.1 request without
hostname (see RFC2616 section 14.23): /
[..time..] [error] Server ran out of threads to serve requests. Consider
raising the ThreadsPerChild setting

Is this problem related to mod_ssl anyhow?
Do you expect any fix for this problem soon?

Regards

P.S. We have the ThreadsPerChild parameter of httpd.conf set to 10.


--------------64192C76DD9A01B614C0BD74
Content-Type: application/octet-stream;
name="filtered"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="filtered"

1MOyoQIABAAAAAAAAAAAAP//AAABAAAATMX+PbflAABKAAAASgAAAAABAsLU 61JUAOeqMggA
RQAAPJwcQAAyBp/O2VOG0awQAJzR5wBQ0ZjBNAAAAACgAhawX48AAAIEBYQE AggKAcZeWwAA
AAABAwMATMX+PQDmAABOAAAATgAAAFJUAOeqMgABAsLU6wgARQAAQLg0QACA BgAArBAAnNlT
htEAUNHnkT0WD9GYwTWwEvrwIdwAAAIEBbQBAwMAAQEICgAAAAAAAAAAAQEE AkzF/j3nAwEA
SgAAAEoAAAAAgMhNi+ZSVADnqjIIAEUAADwWS0AAMgYln9lThtGsEACd0egA UNDMS2UAAAAA
oAIWsNYoAAACBAWEBAIICgHGXlsAAAAAAQMDAE3F/j0v4QUASgAAAEoAAAAA AQLC1OtSVADn
qjIIAEUAADxF+0AAMgb179lThtGsEACc0kYAUNHXGzcAAAAAoAIWsAR+AAAC BAWEBAIICgHG
XswAAAAAAQMDAE3F/j174QUATgAAAE4AAABSVADnqjIAAQLC1OsIAEUAAEC4 NUAAgAYAAKwQ
AJzZU4bRAFDSRpFC1jLR1xs4sBL68AcTAAACBAW0AQMDAAEBCAoAAAAAAAAA AAEBBAJNxf49
I5kNAEIAAABCAAAAAAECwtTrUlQA56oyCABFAAA0RfxAADIG9fbZU4bRrBAA nNJGAFDR1xs4
kULWM4AQFrDLRgAAAQEICgHGXxIAAAAATcX+PY25DQBUAAAAVAAAAAABAsLU 61JUAOeqMggA
RQAARkX9QAAyBvXj2VOG0awQAJzSRgBQ0dcbOJFC1jOAGBaw7IsAAAEBCAoB xl8SAAAAAEdF
VCAvIEhUVFAvMS4xDQoNCk3F/j2cug0AnwIAAJ8CAABSVADnqjIAAQLC1OsI AEUAApG4NkAA
gAYAAKwQAJzZU4bRAFDSRpFC1jPR1xtKgBj63rXzAAABAQgKACJR/QHGXxJI VFRQLzEuMSA0
MDAgQmFkIFJlcXVlc3QNCkRhdGU6IFR1ZSwgMTcgRGVjIDIwMDIgMDY6MzM6 NDkgR01UDQpT
ZXJ2ZXI6IEFwYWNoZS8xLjMuMjcgKFdpbjMyKSBtb2Rfc3NsLzIuOC4xMiBP cGVuU1NMLzAu
OS42ZyBQSFAvNC4yLjAtZGV2DQpDb25uZWN0aW9uOiBjbG9zZQ0KVHJhbnNm ZXItRW5jb2Rp
bmc6IGNodW5rZWQNCkNvbnRlbnQtVHlwZTogdGV4dC9odG1sOyBjaGFyc2V0 PWlzby04ODU5
LTENCg0KMTY5DQo8IURPQ1RZUEUgSFRNTCBQVUJMSUMgIi0vL0lFVEYvL0RU RCBIVE1MIDIu
MC8vRU4iPgo8SFRNTD48SEVBRD4KPFRJVExFPjQwMCBCYWQgUmVxdWVzdDwv VElUTEU+Cjwv
SEVBRD48Qk9EWT4KPEgxPkJhZCBSZXF1ZXN0PC9IMT4KWW91ciBicm93c2Vy IHNlbnQgYSBy
ZXF1ZXN0IHRoYXQgdGhpcyBzZXJ2ZXIgY291bGQgbm90IHVuZGVyc3RhbmQu PFA+CmNsaWVu
dCBzZW50IEhUVFAvMS4xIHJlcXVlc3Qgd2l0aG91dCBob3N0bmFtZSAoc2Vl IFJGQzI2MTYg
c2VjdGlvbiAxNC4yMyk6IC88UD4KPEhSPgo8QUREUkVTUz5BcGFjaGUvMS4z LjI3IFNlcnZl
ciBhdCBsb2NhbGhvc3QgUG9ydCA4MDwvQUREUkVTUz4KPC9CT0RZPjwvSFRN TD4KDQowDQoN
Ck3F/j0Quw0AQgAAAEIAAABSVADnqjIAAQLC1OsIAEUAADS4N0AAgAYAAKwQ AJzZU4bRAFDS
RpFC2JDR1xtKgBH63pKIAAABAQgKACJR/QHGXxJOxf49a2kIAEIAAABCAAAA AAECwtTrUlQA
56oyCABFAAA0Rf5AADIG9fTZU4bRrBAAnNJGAFDR1xtKkULYkIAQGf9zNAAA AQEICgHGX0cA
IlH9TsX+PViHCABKAAAASgAAAAABAsLU61JUAOeqMggARQAAPK8cQAAyBozO 2VOG0awQAJzS
TAG70UjwWwAAAACgAhawLfwAAAIEBYQEAggKAcZfRwAAAAABAwMATsX+PZuH CABOAAAATgAA
AFJUAOeqMgABAsLU6wgARQAAQLg4QACABgAArBAAnNlThtEBu9JMkUeY5dFI 8FywEvrwblQA
AAIEBbQBAwMAAQEICgAAAAAAAAAAAQEEAk7F/j1P5QgAQgAAAEIAAAAAAQLC 1OtSVADnqjII
AEUAADRF/0AAMgb189lThtGsEACc0kYAUNHXG0qRQtiRgBAZ/3MvAAABAQgK AcZfSwAiUf1O
xf49aogMAEIAAABCAAAAAAECwtTrUlQA56oyCABFAAA0rx1AADIGjNXZU4bR rBAAnNJMAbvR
SPBckUeY5oAQFrAyEgAAAQEICgHGX4gAAAAATsX+PZl5DgBKAAAASgAAAAAB AsLU61JUAOeq
MggARQAAPIMdQAAyBrjN2VOG0awQAJzSUQG70RXcjgAAAACgAhawQasAAAIE BYQEAggKAcZf
kwAAAAABAwMATsX+Pex5DgBOAAAATgAAAFJUAOeqMgABAsLU6wgARQAAQLg5 QACABgAArBAA
nNlThtEBu9JRkUm10NEV3I+wEvrwZWIAAAIEBbQBAwMAAQEICgAAAAAAAAAA AQEEAk/F/j2W
AQEATgAAAE4AAABSVADnqjIAAQLC1OsIAEUAAEC4OkAAgAYAAKwQAJzZU4bR AFDR55E9Fg/R
mME1sBL68CHcAAACBAW0AQMDAAEBCAoAAAAAAAAAAAEBBAJPxf49xQ4EAEIA AABCAAAAAAEC
wtTrUlQA56oyCABFAAA0gx5AADIGuNTZU4bRrBAAnNJRAbvRFdyPkUm10YAQ FrAo+QAAAQEI
CgHGX68AAAAAT8X+PaauCABKAAAASgAAAAABAsLU61JUAOeqMggARQAAPP3O QAAyBj4c2VOG
0awQAJzSVQG70diidAAAAACgAhawetcAAAIEBYQEAggKAcZfugAAAAABAwMA T8X+PfWuCABO
AAAATgAAAFJUAOeqMgABAsLU6wgARQAAQLg7QACABgAArBAAnNlThtEBu9JV kUz9ctHYonWw
EvrwVxAAAAIEBbQBAwMAAQEICgAAAAAAAAAAAQEEAk/F/j3D6wgATgAAAE4A AAAAAQLC1OtS
VADnqjIIAEUAAECcHkAAMgafyNlThtGsEACc0ecAUNGYwTWRPRYQsBAWsGC2 AAABAQgKAcZf
ugAAAAABAQUKkT0WD5E9FhBPxf49COkLAEIAAABCAAAAAAECwtTrUlQA56oy CABFAAA0/c9A
ADIGPiPZU4bRrBAAnNJVAbvR2KJ1kUz9c4AQFrAaaQAAAQEICgHGX+0AAAAA T8X+PV27DQBK
AAAASgAAAAABAsLU61JUAOeqMggARQAAPBakQAAyBiVH2VOG0awQAJzSWQG7 0UxJXAAAAACg
Ahaw1DkAAAIEBYQEAggKAcZf+AAAAAABAwMAT8X+Pau7DQBOAAAATgAAAFJU AOeqMgABAsLU
6wgARQAAQLg8QACABgAArBAAnNlThtEBu9JZkU8dA9FMSV2wEvrwkR0AAAIE BbQBAwMAAQEI
CgAAAAAAAAAAAQEEAlDF/j0mggEAQgAAAEIAAAAAAQLC1OtSVADnqjIIAEUA ADQWpUAAMgYl
TtlThtGsEACc0lkBu9FMSV2RTx0EgBAWsFRVAAABAQgKAcZgDgAAAABQxf49 eiIEAEoAAABK
AAAAAAECwtTrUlQA56oyCABFAAA8dq5AADIGxTzZU4bRrBAAnNJdAbvRWxa3 AAAAAKACFrAG
qwAAAgQFhAQCCAoBxmAZAAAAAAEDAwBQxf49yyIEAE4AAABOAAAAUlQA56oy AAECwtTrCABF
AABAuD9AAIAGAACsEACc2VOG0QG70l2RUZ/w0VsWuLAS+vBAwAAAAgQFtAED AwABAQgKAAAA
AAAAAAABAQQCUMX+Pb9VCABCAAAAQgAAAAABAsLU61JUAOeqMggARQAANHav QAAyBsVD2VOG
0awQAJzSXQG70VsWuJFRn/GAEBawA9MAAAEBCAoBxmAzAAAAAFDF/j2klQwA SgAAAEoAAAAA
AQLC1OtSVADnqjIIAEUAADzHt0AAMgZ0M9lThtGsEACc0mEBu9F4p4kAAAAA oAIWsHWSAAAC
BAWEBAIICgHGYD4AAAAAAQMDAFDF/j3tlQwATgAAAE4AAABSVADnqjIAAQLC 1OsIAEUAAEC4
QEAAgAYAAKwQAJzZU4bRAbvSYZFUGaPReKeKsBL68DYXAAACBAW0AQMDAAEB CAoAAAAAAAAA
AAEBBAJRxf49VZUGAEIAAABCAAAAAAECwtTrUlQA56oyCABFAAA0x7hAADIG dDrZU4bRrBAA
nNJhAbvReKeKkVQZpIAQFrD48gAAAQEICgHGYGoAAAAAUcX+PcTyBgBKAAAA SgAAAAABAsLU
61JUAOeqMggARQAAPM1OQAAyBm6c2VOG0awQAJzSvwG70butOwAAAACgAhaw bwgAAAIEBYQE
AggKAcZgdQAAAAABAwMAUcX+PQ3zBgBOAAAATgAAAFJUAOeqMgABAsLU6wgA RQAAQLhBQACA
BgAArBAAnNlThtEBu9K/kVbsxdG7rTywEvrwXJ8AAAIEBbQBAwMAAQEICgAA AAAAAAAAAQEE
AlHF/j1YbQ4AQgAAAEIAAAAAAQLC1OtSVADnqjIIAEUAADTNT0AAMgZuo9lT htGsEACc0r8B
u9G7rTyRVuzGgBAWsB88AAABAQgKAcZgqQAAAABSxf49c4cGAEoAAABKAAAA AAECwtTrUlQA
56oyCABFAAA8foJAADIGvWjZU4bRrBAAnNLDAbvR0h42AAAAAKACFrD9swAA AgQFhAQCCAoB
xmC0AAAAAAEDAwBSxf49yIcGAE4AAABOAAAAUlQA56oyAAECwtTrCABFAABA uEJAAIAGAACs
EACc2VOG0QG70sORW6tN0dIeN7AS+vAs/QAAAgQFtAEDAwABAQgKAAAAAAAA AAABAQQCU8X+
PU7XAwBCAAAAQgAAAAABAsLU61JUAOeqMggARQAANH6DQAAyBr1v2VOG0awQ AJzSwwG70dIe
N5Fbq06AEBaw7zcAAAEBCAoBxmELAAAAAFPF/j3bXwQASgAAAEoAAAAAAQLC 1OtSVADnqjII
AEUAADwUaEAAMgYng9lThtGsEACc0scBu9IMdX4AAAAAoAIWsKXLAAACBAWE BAIICgHGYRYA
AAAAAQMDAFPF/j0iYAQATgAAAE4AAABSVADnqjIAAQLC1OsIAEUAAEC4Q0AA gAYAAKwQAJzZ
U4bRAbvSx5FfvxHSDHV/sBL68MGuAAACBAW0AQMDAAEBCAoAAAAAAAAAAAEB BAJTxf49K8IK
AEIAAABCAAAAAAECwtTrUlQA56oyCABFAAA0FGlAADIGJ4rZU4bRrBAAnNLH AbvSDHV/kV+/
EoAQFrCDlAAAAQEICgHGYWAAAAAAU8X+PcoeCwBKAAAASgAAAAABAsLU61JU AOeqMggARQAA
PF+7QAAyBtwv2VOG0awQAJzS6wG70Zw+0AAAAACgAhaw3HAAAAIEBYQEAggK AcZhawAAAAAB
AwMAU8X+PR0fCwBOAAAATgAAAFJUAOeqMgABAsLU6wgARQAAQLhEQACABgAA rBAAnNlThtEB
u9LrkWI+CdGcPtGwEvrwea4AAAIEBbQBAwMAAQEICgAAAAAAAAAAAQEEAlTF /j3mtQcAQgAA
AEIAAAAAAQLC1OtSVADnqjIIAEUAADRfvEAAMgbcNtlThtGsEACc0usBu9Gc PtGRYj4KgBAW
sDtnAAABAQgKAcZhjQAAAABUxf49I14JAEoAAABKAAAAAAECwtTrUlQA56oy CABFAAA82H5A
ADIGY2zZU4bRrBAAnNLtAbvRWbnmAAAAAKACFrBhbgAAAgQFhAQCCAoBxmGY AAAAAAEDAwBU
xf49X14JAE4AAABOAAAAUlQA56oyAAECwtTrCABFAABAuEVAAIAGAACsEACc 2VOG0QG70u2R
ZqaX0Vm557AS+vCWRgAAAgQFtAEDAwABAQgKAAAAAAAAAAABAQQCVcX+PSVT BgBCAAAAQgAA
AAABAsLU61JUAOeqMggARQAANNh/QAAyBmNz2VOG0awQAJzS7QG70Vm555Fm ppiAEBawV6cA
AAEBCAoBxmHlAAAAAFXF/j0KmwYASgAAAEoAAAAAAQLC1OtSVADnqjIIAEUA ADxVMEAAMgbm
utlThtGsEACc0vMBu9I8NMAAAAAAoAIWsOVTAAACBAWEBAIICgHGYfAAAAAA AQMDAFXF/j1d
mwYATgAAAE4AAABSVADnqjIAAQLC1OsIAEUAAEC4RkAAgAYAAKwQAJzZU4bR AbvS85Fqi5XS
PDTBsBL68DWCAAACBAW0AQMDAAEBCAoAAAAAAAAAAAEBBAJWxf49NAEBAEIA AABCAAAAAAEC
wtTrUlQA56oyCABFAAA0VTFAADIG5sHZU4bRrBAAnNLzAbvSPDTBkWqLloAQ FrD2kAAAAQEI
CgHGYjcAAAAAVsX+PV7eAgBKAAAASgAAAAABAsLU61JUAOeqMggARQAAPCdk QAAyBhSH2VOG
0awQAJzS9wG70fpFJgAAAACgAhaw1NkAAAIEBYQEAggKAcZiQgAAAAABAwMA VsX+PbDeAgBO
AAAATgAAAFJUAOeqMgABAsLU6wgARQAAQLhHQACABgAArBAAnNlThtEBu9L3 kW4yBNH6RSew
EvrwfucAAAIEBbQBAwMAAQEICgAAAAAAAAAAAQEEAlbF/j1wXwkAQgAAAEIA AAAAAQLC1OtS
VADnqjIIAEUAADQnZUAAMgYUjtlThtGsEACc0vcBu9H6RSeRbjIFgBAWsD+q AAABAQgKAcZi
gwAAAABWxf49Ar4JAEoAAABKAAAAAAECwtTrUlQA56oyCABFAAA8c7lAADIG yDHZU4bRrBAA
nNL6AbvRuBE3AAAAAKACFrAIvAAAAgQFhAQCCAoBxmKOAAAAAAEDAwBWxf49 RL4JAE4AAABO
AAAAUlQA56oyAAECwtTrCABFAABAuEhAAIAGAACsEACc2VOG0QG70vqRcJz0 0bgROLAS+vBI
IwAAAgQFtAEDAwABAQgKAAAAAAAAAAABAQQCV8X+PUoHAQBCAAAAQgAAAAAB AsLU61JUAOeq
MggARQAANHO6QAAyBsg42VOG0awQAJzS+gG70bgROJFwnPWAEBawCLkAAAEB CAoBxmKwAAAA
AFfF/j0okgIASgAAAEoAAAAAAQLC1OtSVADnqjIIAEUAADyNTEAAMgauntlT htGsEACc0v0B
u9Jl7/cAAAAAoAIWsCkeAAACBAWEBAIICgHGYrsAAAAAAQMDAFfF/j1jkgIA TgAAAE4AAABS
VADnqjIAAQLC1OsIAEUAAEC4SkAAgAYAAKwQAJzZU4bRAbvS/ZFzfl7SZe/4 sBL68IdFAAAC
BAW0AQMDAAEBCAoAAAAAAAAAAAEBBAJXxf49vAMLAEIAAABCAAAAAAECwtTr UlQA56oyCABF
AAA0jU1AADIGrqXZU4bRrBAAnNL9AbvSZe/4kXN+X4AQFrBHpgAAAQEICgHG YuUAAAAAV8X+
PZAeDQBKAAAASgAAAAABAsLU61JUAOeqMggARQAAPIZXQAAyBrWT2VOG0awQ AJzTAAG70ivk
pwAAAACgAhawNHAAAAIEBYQEAggKAcZi8AAAAAABAwMAV8X+PcseDQBOAAAA TgAAAFJUAOeq
MgABAsLU6wgARQAAQLhLQACABgAArBAAnNlThtEBu9MAkXcmXdIr5KiwEvrw 6skAAAIEBbQB
AwMAAQEICgAAAAAAAAAAAQEEAljF/j2DyAkAQgAAAEIAAAAAAQLC1OtSVADn qjIIAEUAADSG
WEAAMga1mtlThtGsEACc0wABu9Ir5KiRdyZegBAWsKrlAAABAQgKAcZjKgAA AABYxf49GVAK
AEoAAABKAAAAAAECwtTrUlQA56oyCABFAAA8aytAADIG0L/ZU4bRrBAAnNMD AbvSOQgeAAAA
AKACFrAQpAAAAgQFhAQCCAoBxmM1AAAAAAEDAwBYxf49VVAKAE4AAABOAAAA UlQA56oyAAEC
wtTrCABFAABAuExAAIAGAACsEACc2VOG0QG70wORewyh0jkIH7AS+vDg+gAA AgQFtAEDAwAB
AQgKAAAAAAAAAAABAQQCWcX+PUeECABCAAAAQgAAAAABAsLU61JUAOeqMggA RQAANGssQAAy
BtDG2VOG0awQAJzTAwG70jkIH5F7DKKAEBawoMUAAAEBCAoBxmN7AAAAAFnF /j1OAQkASgAA
AEoAAAAAAQLC1OtSVADnqjIIAEUAADyQs0AAMgarN9lThtGsEACc02ABu9HW 8zUAAAAAoAIW
sCVBAAACBAWEBAIICgHGY4YAAAAAAQMDAFnF/j2IAQkATgAAAE4AAABSVADn qjIAAQLC1OsI
AEUAAEC4TUAAgAYAAKwQAJzZU4bRAbvTYJF/Oj/R1vM2sBL68MhGAAACBAW0 AQMDAAEBCAoA
AAAAAAAAAAEBBAJZxf491JENAEIAAABCAAAAAAECwtTrUlQA56oyCABFAAA0 kLRAADIGqz7Z
U4bRrBAAnNNgAbvR1vM2kX86QIAQFrCHtQAAAQEICgHGY9cAAAAAWsX+PY86 AQBKAAAASgAA
AAABAsLU61JUAOeqMggARQAAPCzvQAAyBg782VOG0awQAJzTYwG70m9PDQAA AACgAhawyHEA
AAIEBYQEAggKAcZj4gAAAAABAwMAWsX+Pdw6AQBOAAAATgAAAFJUAOeqMgAB AsLU6wgARQAA
QLhOQACABgAArBAAnNlThtEBu9NjkYINFdJvTw6wEvrwmPoAAAIEBbQBAwMA AQEICgAAAAAA
AAAAAQEEAlrF/j1ObAgAQgAAAEIAAAAAAQLC1OtSVADnqjIIAEUAADQs8EAA MgYPA9lThtGs
EACc02MBu9JvTw6Rgg0WgBAWsFg4AAABAQgKAcZkCAAAAABaxf49s2UJAEoA AABKAAAAAAEC
wtTrUlQA56oyCABFAAA8iQxAADIGst7ZU4bRrBAAnNNlAbvSY+0fAAAAAKAC FrAqOAAAAgQF
hAQCCAoBxmQTAAAAAAEDAwBaxf497WUJAE4AAABOAAAAUlQA56oyAAECwtTr CABFAABAuE9A
AIAGAACsEACc2VOG0QG702WRhPLD0mPtILAS+vAVQQAAAgQFtAEDAwABAQgK AAAAAAAAAAAB
AQQCW8X+PbhVBQBCAAAAQgAAAAABAsLU61JUAOeqMggARQAANIkNQAAyBrLl 2VOG0awQAJzT
ZQG70mPtIJGE8sSAEBaw1EkAAAEBCAoBxmQ9AAAAAFvF/j1d8QUASgAAAEoA AAAAAQLC1OtS
VADnqjIIAEUAADxQekAAMgbrcNlThtGsEACc04oBu9KgNDIAAAAAoAIWsOKO AAACBAWEBAII
CgHGZEgAAAAAAQMDAFvF/j2q8QUATgAAAE4AAABSVADnqjIAAQLC1OsIAEUA AEC4UEAAgAYA
AKwQAJzZU4bRAbvTipGIMdfSoDQzsBL68I61AAACBAW0AQMDAAEBCAoAAAAA AAAAAAEBBAJc
xf49kxQCAEIAAABCAAAAAAECwtTrUlQA56oyCABFAAA0UHtAADIG63fZU4bR rBAAnNOKAbvS
oDQzkYgx2IAQFrBNcAAAAQEICgHGZIsAAAAAXMX+PcA1AgBKAAAASgAAAAAB AsLU61JUAOeq
MggARQAAPDLTQAAyBgkY2VOG0awQAJzTiwG70jBWWAAAAACgAhawwJQAAAIE BYQEAggKAcZk
iwAAAAABAwMAXMX+Pfo1AgBOAAAATgAAAFJUAOeqMgABAsLU6wgARQAAQLhR QACABgAArBAA
nNlThtEBu9OLkYvhmNIwVlmwEvrwvTkAAAIEBbQBAwMAAQEICgAAAAAAAAAA AQEEAlzF/j2Q
cgwAQgAAAEIAAAAAAQLC1OtSVADnqjIIAEUAADQy1EAAMgYJH9lThtGsEACc 04sBu9IwVlmR
i+GZgBAWsHupAAABAQgKAcZk1gAAAABcxf49MYUMAHUAAAB1AAAAAAECwtTr UlQA56oyCABF
AABnUHxAADIG60PZU4bRrBAAnNOKAbvSoDQzkYgx2IAYFrDIeQAAAQEICgHG ZNYAAAAAgDEB
AAIAGAAAABAHAMAFAIADAIABAIAIAIAGAEAEAIACAIBVcVozP0w2bFwRKjAV aCYCXcX+Pcso
AABCAAAAQgAAAFJUAOeqMgABAsLU6wgARQAANLhSQACABgAArBAAnNlThtEB u9OKkYgx2NKg
NGaAEPq9Fi4AAAEBCAoAIlKUAcZk1o3G/j3jhw0ANgAAADYAAABSVADnqjIA AQLC1OsIAEUA
ACi44EAAgAYAAKwQAJzZU4bRAbvSx5FfvxKVmIpvUAQAAF4SAACNxv49WYgN ADYAAAA2AAAA
UlQA56oyAAECwtTrCABFAAAouOFAAIAGAACsEACc2VOG0QG70v2Rc35flZiK b1AEAACeewAA
jcb+PZGIDQA2AAAANgAAAFJUAOeqMgABAsLU6wgARQAAKLjiQACABgAArBAA nNlThtEBu9JZ
kU8dBJWYim9QBAAAAJ8AAI3G/j3JiA0ANgAAADYAAABSVADnqjIAAQLC1OsI AEUAACi440AA
gAYAAKwQAJzZU4bRAbvSw5Fbq06VmIpvUAQAAHHeAACNxv49AokNADYAAAA2 AAAAUlQA56oy
AAECwtTrCABFAAAouORAAIAGAACsEACc2VOG0QG70vORaouWlZiKb1AEAACR VwAAjcb+PUKJ
DQA2AAAANgAAAFJUAOeqMgABAsLU6wgARQAAKLjlQACABgAArBAAnNlThtEB u9L6kXCc9ZWY
im9QBAAAf+sAAI3G/j13iQ0ANgAAADYAAABSVADnqjIAAQLC1OsIAEUAACi4 5kAAgAYAAKwQ
AJzZU4bRAbvS65FiPgqVmIpvUAQAAN7zAACNxv49sYkNADYAAAA2AAAAUlQA 56oyAAECwtTr
CABFAAAouOdAAIAGAACsEACc2VOG0QG70veRbjIFlZiKb1AEAADq4AAAjcb+ PeyJDQA2AAAA
NgAAAFJUAOeqMgABAsLU6wgARQAAKLjoQACABgAArBAAnNlThtEBu9LtkWam mJWYim9QBAAA
dl8AAI3G/j1Fig0ANgAAADYAAABSVADnqjIAAQLC1OsIAEUAACi46UAAgAYA AKwQAJzZU4bR
AbvSUZFJtdGVmIpvUAQAAGffAACNxv49h4oNADYAAAA2AAAAUlQA56oyAAEC wtTrCABFAAAo
uOpAAIAGAACsEACc2VOG0QG70r+RVuzGlZiKb1AEAAAwbwAAjcb+PdWKDQA2 AAAANgAAAFJU
AOeqMgABAsLU6wgARQAAKLjrQACABgAArBAAnNlThtEBu9NjkYINFpWYim9Q BAAAD1AAAI3G
/j0Riw0ANgAAADYAAABSVADnqjIAAQLC1OsIAEUAACi47EAAgAYAAKwQAJzZ U4bRAFDR55E9
FhCVmIpvUAQAAAmCAACNxv49SYsNADYAAAA2AAAAUlQA56oyAAECwtTrCABF AAAouO1AAIAG
AACsEACc2VOG0QG70kyRR5jmlZiKb1AEAACE0QAAjcb+PYSLDQA2AAAANgAA AFJUAOeqMgAB
AsLU6wgARQAAKLjuQACABgAArBAAnNlThtEBu9MAkXcmXpWYim9QBAAA9nUA AI3G/j25iw0A
NgAAADYAAABSVADnqjIAAQLC1OsIAEUAACi470AAgAYAAKwQAJzZU4bRAbvT YJF/OkCVmIpv
UAQAAOIrAACNxv498IsNADYAAAA2AAAAUlQA56oyAAECwtTrCABFAAAouPBA AIAGAACsEACc
2VOG0QG704qRiDHYlZiKb1AEAADqYAAAjcb+PSuMDQA2AAAANgAAAFJUAOeq MgABAsLU6wgA
RQAAKLjxQACABgAArBAAnNlThtEBu9JVkUz9c5WYim9QBAAAIDYAAI3G/j1k jA0ANgAAADYA
AABSVADnqjIAAQLC1OsIAEUAACi48kAAgAYAAKwQAJzZU4bRAbvSYZFUGaSV mIpvUAQAAAPy
AACNxv49pIwNADYAAAA2AAAAUlQA56oyAAECwtTrCABFAAAouPNAAIAGAACs EACc2VOG0QG7
0wORewyilZiKb1AEAAAQKwAAjcb+Pd2MDQA2AAAANgAAAFJUAOeqMgABAsLU 6wgARQAAKLj0
QACABgAArBAAnNlThtEBu9JdkVGf8ZWYim9QBAAAfasAAI3G/j0UjQ0ANgAA ADYAAABSVADn
qjIAAQLC1OsIAEUAACi49UAAgAYAAKwQAJzZU4bRAbvTi5GL4ZmVmIpvUAQA ADqbAACNxv49
SI0NADYAAAA2AAAAUlQA56oyAAECwtTrCABFAAAouPZAAIAGAACsEACc2VOG 0QG702WRhPLE
lZiKb1AEAAApnQAAjsb+PVOJAwBCAAAAQgAAAAABAsLU61JUAOeqMggARQAA NP3QQAAyBj4i
2VOG0awQAJzSVQG70diidZFM/XOAERawngoAAAEBCAoBxtxKAAAAAI7G/j2e iQMANgAAADYA
AABSVADnqjIAAQLC1OsIAEUAACi4+AAAgAZ1BqwQAJzZU4bRAbvSVZFM/XOR TP1zUAQAALF9
AACOxv49tZ0DAEIAAABCAAAAAAECwtTrUlQA56oyCABFAAA0drBAADIGxULZ U4bRrBAAnNJd
AbvRWxa4kVGf8YARFrCHugAAAQEICgHG3EoAAAAAjsb+PcudAwA2AAAANgAA AFJUAOeqMgAB
AsLU6wgARQAAKLj5AACABnUFrBAAnNlThtEBu9JdkVGf8ZFRn/FQBAAAbHAA AI7G/j2TsgMA
QgAAAEIAAAAAAQLC1OtSVADnqjIIAEUAADTHuUAAMgZ0OdlThtGsEACc0mEB u9F4p4qRVBmk
gBEWsH0RAAABAQgKAcbcSgAAAACOxv49qLIDADYAAAA2AAAAUlQA56oyAAEC wtTrCABFAAAo
uPoAAIAGdQSsEACc2VOG0QG70mGRVBmkkVQZpFAEAAB5AQAAjsb+PXLGAwBC AAAAQgAAAAAB
AsLU61JUAOeqMggARQAANGstQAAyBtDF2VOG0awQAJzTAwG70jkIH5F7DKKA ERawJ/UAAAEB
CAoBxtxKAAAAAI7G/j2HxgMANgAAADYAAABSVADnqjIAAQLC1OsIAEUAACi4 +wAAgAZ1A6wQ
AJzZU4bRAbvTA5F7DKKRewyiUAQAAJIVAACOxv49QtsDAEIAAABCAAAAAAEC wtTrUlQA56oy
CABFAAA0iQ5AADIGsuTZU4bRrBAAnNNlAbvSY+0gkYTyxIARFrBcOwAAAQEI CgHG3EoAAAAA
jsb+PVfbAwA2AAAANgAAAFJUAOeqMgABAsLU6wgARQAAKLj8AACABnUCrBAA nNlThtEBu9Nl
kYTyxJGE8sRQBAAAxVsAAI7G/j2u+wMAQgAAAEIAAAAAAQLC1OtSVADnqjII AEUAADQy1UAA
MgYJHtlThtGsEACc04sBu9IwVlmRi+GZgBEWsAQ0AAABAQgKAcbcSgAAAACO xv49w/sDADYA
AAA2AAAAUlQA56oyAAECwtTrCABFAAAouP0AAIAGdQGsEACc2VOG0QG704uR i+GZkYvhmVAE
AADnfQAA
--------------64192C76DD9A01B614C0BD74--

____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

RE: DoS attack on mod_ssl 2.8.12 ??

am 19.12.2002 17:24:06 von HMajidy

I have heard from several sources Apache version 1.x for Windows does not
thread very well. The first real Win32 version is Apache 2.0. This does not
answer your question, I know, but it's something to consider in formulating
a long-term solution.

-----Original Message-----
From: owner-modssl-users@modssl.org [mailto:owner-modssl-users@modssl.org]On
Behalf Of Sergey Strakhov
Sent: Thursday, December 19, 2002 8:04 AM
To: modssl-users@modssl.org
Cc: Pedro Nascimento; Greg Davydouski
Subject: DoS attack on mod_ssl 2.8.12 ??


Hello,

We are experiencing problems with our Win32 Apache 1.3.27 with mod_ssl
2.8.12 + openssl 0.9.6g running on Windows 2000.
It is a sort of DoS attack that makes our web site totally inaccessible.

One of those attacks was captured with Ethereal. The dump is attached.

As you can see, the attack is accomplished through both HTTP (80) and
HTTPS (443) ports.
First, the connection is opened to the HTTP port and a malformed
HTTP/1.1 GET request (with no Host: header) is sent to the HTTP port
(probably with an intention to produce a crash described in
http://www.cert.org/advisories/CA-2002-27.html or just to determine the
host's Server version). The server responds with "HTTP/1.1 400 Bad
request" and closes the connection. After that the attacker starts
opening connections to the HTTPS port. One of them is used to send SSLv2
Client Hello request. From this point the web server starts rejecting
all incoming connections and the web site stops responding on both HTTP
and HTTPS ports.

The error log usually contains records like:

[..time..] [error] [client ..] client sent HTTP/1.1 request without
hostname (see RFC2616 section 14.23): /
[..time..] [error] Server ran out of threads to serve requests. Consider
raising the ThreadsPerChild setting

Is this problem related to mod_ssl anyhow?
Do you expect any fix for this problem soon?

Regards

P.S. We have the ThreadsPerChild parameter of httpd.conf set to 10.



____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

Re: DoS attack on mod_ssl 2.8.12 ??

am 20.12.2002 05:34:38 von hunter

On Thu, 2002-12-19 at 11:03, Sergey Strakhov wrote:
> Hello,
>
> We are experiencing problems with our Win32 Apache 1.3.27 with mod_ssl
> 2.8.12 + openssl 0.9.6g running on Windows 2000.
> It is a sort of DoS attack that makes our web site totally inaccessible.
>
> One of those attacks was captured with Ethereal. The dump is attached.
>
> As you can see, the attack is accomplished through both HTTP (80) and
> HTTPS (443) ports.
> First, the connection is opened to the HTTP port and a malformed
> HTTP/1.1 GET request (with no Host: header) is sent to the HTTP port
> (probably with an intention to produce a crash described in
> http://www.cert.org/advisories/CA-2002-27.html or just to determine the
> host's Server version). The server responds with "HTTP/1.1 400 Bad
> request" and closes the connection. After that the attacker starts
> opening connections to the HTTPS port. One of them is used to send SSLv2
> Client Hello request. From this point the web server starts rejecting
> all incoming connections and the web site stops responding on both HTTP
> and HTTPS ports.
>
> The error log usually contains records like:
>
> [..time..] [error] [client ..] client sent HTTP/1.1 request without
> hostname (see RFC2616 section 14.23): /
> [..time..] [error] Server ran out of threads to serve requests. Consider
> raising the ThreadsPerChild setting
>
> Is this problem related to mod_ssl anyhow?
> Do you expect any fix for this problem soon?
>
> Regards
>
> P.S. We have the ThreadsPerChild parameter of httpd.conf set to 10.
>

Your code is very much out of date ... it is exploitable and DOSable

I saw many people in the summer describe similar reports as yours,
prompting me to build Apache binaries for many of those that were
suffering.

You cannot continue to run with openssl 0.9.6g -- openssl 0.9.6h is the
current version. My advice is do not waste your time trying to
understand it.

You can get reliable up-to-date binaries from me ;) Other people are
downloading the binaries as well.

http://hunter.campbus.com/
Apache_1.3.27-Mod_SSL_2.8.11-OpenSSL_0.9.6h-Win32.zip

http://hunter.campbus.com/Openssl-0.9.6h-Win32.zip

http://hunter.campbus.com/Apache_2.0.43-OpenSSL_0.9.6h-Win32 .zip

You can also get them from my server ... md5's are avaialble from my
server as well.

http://tor.ath.cx/~hunter/
Apache_1.3.27-Mod_SSL_2.8.11-OpenSSL_0.9.6h-Win32.zip

http://tor.ath.cx/~hunter/Openssl-0.9.6h-Win32.zip

http://tor.ath.cx/~hunter/Apache_2.0.43-OpenSSL_0.9.6h-Win32 .zip

You are welcome to contac me directly
h u n t e r @ t o r . a t h . c x

If you need instructions on how to rebuild the code, I have to look for
them - they are messy (for Apache2) and can be found in the archives -
search for 'apache hunter masm' -- apache 1.3.27 is easy to build let me
know if you need help.

hunter


____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

RE: DoS attack on mod_ssl 2.8.12 ??

am 20.12.2002 09:31:33 von Boyle Owen

There is a major thread running on the openssl list about this very
thing (Slapper worm)... Starts here:

http://www.mail-archive.com/openssl-users@openssl.org/msg297 62.html

Rgds,

Owen Boyle

>-----Original Message-----
>From: Sergey Strakhov [mailto:strakhov@01com.com]
>Sent: Donnerstag, 19. Dezember 2002 17:04
>To: modssl-users@modssl.org
>Cc: Pedro Nascimento; Greg Davydouski
>Subject: DoS attack on mod_ssl 2.8.12 ??
>
>
>Hello,
>
>We are experiencing problems with our Win32 Apache 1.3.27 with mod_ssl
>2.8.12 + openssl 0.9.6g running on Windows 2000.
>It is a sort of DoS attack that makes our web site totally
>inaccessible.
>
>One of those attacks was captured with Ethereal. The dump is attached.
>
>As you can see, the attack is accomplished through both HTTP (80) and
>HTTPS (443) ports.
>First, the connection is opened to the HTTP port and a malformed
>HTTP/1.1 GET request (with no Host: header) is sent to the HTTP port
>(probably with an intention to produce a crash described in
>http://www.cert.org/advisories/CA-2002-27.html or just to determine the
>host's Server version). The server responds with "HTTP/1.1 400 Bad
>request" and closes the connection. After that the attacker starts
>opening connections to the HTTPS port. One of them is used to
>send SSLv2
>Client Hello request. From this point the web server starts rejecting
>all incoming connections and the web site stops responding on both HTTP
>and HTTPS ports.
>
>The error log usually contains records like:
>
>[..time..] [error] [client ..] client sent HTTP/1.1 request without
>hostname (see RFC2616 section 14.23): /
>[..time..] [error] Server ran out of threads to serve
>requests. Consider
>raising the ThreadsPerChild setting
>
>Is this problem related to mod_ssl anyhow?
>Do you expect any fix for this problem soon?
>
>Regards
>
>P.S. We have the ThreadsPerChild parameter of httpd.conf set to 10.
>
>

This message is for the named person's use only. It may contain
confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this message in error, please notify the sender urgently
and then immediately delete the message and any copies of it from your
system. Please also immediately destroy any hardcopies of the message.
You must not, directly or indirectly, use, disclose, distribute, print,
or copy any part of this message if you are not the intended recipient.
The sender's company reserves the right to monitor all e-mail
communications through their networks. Any views expressed in this
message are those of the individual sender, except where the message
states otherwise and the sender is authorised to state them to be the
views of the sender's company.
____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org