4 ms·
I was able to reproduce this issue on Apache 2.2.22 with a legitimate method: <LIMIT GET> Allow from x.y.z.v Deny from all </LIMIT> for I in `seq 1
by wielebny 9y ago
I was able to reproduce this issue on Apache 2.2.22 with a legitimate method:
<LIMIT GET>
Allow from x.y.z.v
Deny from all
</LIMIT>
for I in `seq 1 100`; do curl -sI -X OPTIONS http://myhost/ | grep ^Allow; done | uniq
Allow: ,GET,HEAD,POST,OPTIONS
Allow: GET,HEAD,POST,OPTIONS
Allow: ,GET,HEAD,POST,OPTIONS
Allow: GET,HEAD,POST,OPTIONS
- abjorn 9y agoThis doesn't quite look like the same bug described in the article. Maybe the inconsistency with the comma separator is a separate bug?
- wielebny 9y agoMost certainly something is leaking: l-lbiegaj ~ -> curl -sI -X OPTIONS http://mysite/ | grep ^Allow Allow: allow,HEAD,GET,HEAD,POST,OPTIONS Value returned in 'Allow' changes with every apache2 restart, but I haven't yet seen any parts of the config or something other than extraneous commans or 'allow' string.
- justinclift 9y agoInteresting. Maybe see if it still leaks with the patch jimjag points out below? http://svn.apache.org/viewvc?view=revision&revision=1807754 http://svn.apache.org/viewvc?view=revision&revision=1807754
- wielebny 9y agoAfter many repeated tests with multiple LIMIT sections in .htaccess (and without restarting apache2) i've managed to get a leak of part of config file: Allow: �E2�~,HEAD,,ex.html/,OPTIONS,POST,,HEAD,,HEAD,Pek�~,HEAD,,,ex.html/,GET,HEAD