|
Ä¿ÇÇÇâÀÌ ³ª´Â *NIX
Ä¿ÇǴнº
½Ã½ºÅÛ/³×Æ®¿÷/º¸¾ÈÀ» ´Ù·ç´Â °÷
|
|
|
|
ÀÌÀü ÁÖÁ¦ º¸±â :: ´ÙÀ½ ÁÖÁ¦ º¸±â |
±Û¾´ÀÌ |
¸Þ½ÃÁö |
truefeel Ä«Æä °ü¸®ÀÚ
°¡ÀÔ: 2003³â 7¿ù 24ÀÏ ¿Ã¸° ±Û: 1277 À§Ä¡: ´ëÇѹα¹
|
¿Ã·ÁÁü: 2011.9.02 ±Ý, 1:30 pm ÁÖÁ¦: ¾ÆÆÄÄ¡ À¥¼¹ö, ½É°¢ÇÑ DoS Ãë¾àÁ¡°ú ÆÐÄ¡ ¹öÀü |
|
|
¾ó¸¶Àü '¾ÆÆÄÄ¡ À¥¼¹ö¸¦ Çѹ濡 ´Ù¿î½ÃÅ°´Â Range¿äû Ãë¾àÁ¡' (±Û ÁÁÀºÁøÈ£)ÀÌ ¹ßÇ¥µÇ¾ú´Ù.
±¹³»¿¡¼´Â ÀÌ DoS Ãë¾àÁ¡¿¡ ´ëÇØ ³Ê¹«³ª Á¶¿ëÇÏÁö¸¸, Çѹ濡 ¼¹ö¸¦ ´Ù¿î½Ãų ¼ö ÀÖ´Â ½É°¢ÇÑ ¹®Á¦ÀÌ´Ù. ¾ÆÆÄÄ¡ À¥¼¹ö(Apache)¿¡ Á¤»óÀûÀÌÁö ¾ÊÀº ÇüÅ·ΠRange Çì´õ¸¦ ¿äûÇϸé, À¥¼¹öÀÇ load´Â ´Ü ¸îÃʸ¸¿¡ ±Þ»ó½ÂÇÏ¿© ¼¹ö´Â ÀÀ´äÀ» ó¸®ÇÒ ¼ö°¡ ¾ø´Ù.
¾ÆÆÄÄ¡ 1.3, 2.0, 2.2¹öÀü´ë ¸ðµÎ DoS Ãë¾àÁ¡ÀÌ Á¸ÀçÇÑ´Ù. 31ÀÏ(¼ö)¿¡ DoS Ãë¾àÁ¡À» ÆÐÄ¡ÇÑ 2.2.20 ¹öÀüÀ» ¹ßÇ¥Çß´Ù.
Àοë: |
SECURITY: CVE-2011-3192 (cve.mitre.org) core: Fix handling of byte-range requests to use less memory, to avoid denial of service. If the sum of all ranges in a request is larger than the original file, ignore the ranges and send the complete file. PR 51714. |
¿¹Àü 1.3.x¹öÀü ¿î¿µÁßÀÎ ºÐµéÀº ´õ ÀÌ»ó Áö¿øÇÏÁö ¾Ê´Â ¹öÀü´ë¸¦ ¹ö¸®°í 2.2.x´ë·Î °¥¾ÆŸ½Ã±â ±ÇÀåÇÑ´Ù. 2.2.20 Å×½ºÆ® °á°ú, ÇØ´ç Ãë¾àÁ¡ÀÌ ÆÐÄ¡µÈ °ÍÀ» È®ÀÎÇß´Ù.
¾ÆÆÄÄ¡ À¥¼¹ö¸¦ »ç¿ëÇÏ´Â ¾îÇöóÀ̾𽺠Àåºñµéµµ ÁÖÀÇ°¡ ÇÊ¿äÇÏ´Ù. ¾ÆÆÄÄ¡ ±â¹Ý À¥¼¹öµé(´ëÇ¥ÀûÀÎ °ÍÀÌ ¿À¶óŬ ias)µµ ¸¶Âù°¡Áö´Ù. Cisco´Â ¾ó¸¶Àü ¾ÆÆÄÄ¡¸¦ »ç¿ëÇÏ´Â ÀÚ»ç Á¦Ç°¿¡ ´ëÇØ º¸¾È±Ç°í»çÇ×À» ¹ßÇ¥Çß´Ù.
Cisco Security Advisory: Apache HTTPd Range Header Denial of Service Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20110830-apache.shtml
À§Ã³·³ ¼¹ö¸¸ »ìÆìºÁ¼´Â ¾ÈµÈ´Ù. ¾ÆÆÄÄ¡°¡ ¿î¿µµÇ´Â ¾îÇöóÀ̾𽺱îÁö ²À »ìÆìºÁ¾ß ÇÑ´Ù. ¿ÜºÎ¿¡¼ ÀÌ Àåºñµé¿¡°Ô Á¢±ÙÀÌ °¡´ÉÇÏ´Ù¸é ¼ºñ½º Àå¾Ö¿¡ ½É°¢ÇÑ ¿ä¼Ò°¡ µÉ ¼ö ÀÖ´Ù.
* Apache 2.2.20 Release Á¤º¸ :
¡¡ http://www.apache.org/dist/httpd/Announcement2.2.html
¡¡ http://www.apache.org/dist/httpd/CHANGES_2.2.20
* ´Ù¿î¹Þ±â : http://ftp.daum.net/apache/httpd/
* °ü·Ã±Û : Apache killer À§Çù (jjun´Ô) ( 2011.8.29 )
¡Ø ±¹³»ÀÇ ´ëÀÀÀÌ ³Ê¹« ´Ê°í ½É°¢¼ºÀ» ¸ð¸£´Â °Í °°¾Æ¼, ºí·Î±×¿¡ ½è´ø ±ÛÀ» Á¶±Ý ¼öÁ¤ÇÏ¿© ¿Ã¸°´Ù. |
|
À§·Î |
|
![](templates/subSilver/images/spacer.gif) |
|
|
»õ·Î¿î ÁÖÁ¦¸¦ ¿Ã¸± ¼ö ÀÖ½À´Ï´Ù ´ä±ÛÀ» ¿Ã¸± ¼ö ÀÖ½À´Ï´Ù ÁÖÁ¦¸¦ ¼öÁ¤ÇÒ ¼ö ¾ø½À´Ï´Ù ¿Ã¸° ±ÛÀ» »èÁ¦ÇÒ ¼ö ¾ø½À´Ï´Ù ÅõÇ¥¸¦ ÇÒ ¼ö ¾ø½À´Ï´Ù
|
Powered by phpBB © 2001, 2005 phpBB Group
|