Check: WA000-WWA066 A24
Apache Server 2.4 Unix:
WA000-WWA066 A24
(in version v1 r1)
Title
The HTTP request line must be limited. (Cat II impact)
Discussion
Buffer overflow attacks are carried out by a malicious attacker sending amounts of data that the web server cannot store in a given size buffer. The eventual overflow of this buffer can overwrite system memory. Subsequently an attacker may be able to elevate privileges and take control of the server. This Apache directives limits the size of the various HTTP header sizes thereby limiting the chances for a buffer overflow. The LimitRequestLine directive allows the server administrator to reduce or increase the limit on the allowed size of a client's HTTP request-line. Since the request-line consists of the HTTP method, URI, and protocol version, the LimitRequestLine directive places a restriction on the length of a request-URI allowed for a request on the server. A server needs this value to be large enough to hold any of its resource names, including any information that might be passed in the query part of a GET request. This directive gives the server administrator greater control over abnormal client request behavior, which may be useful for avoiding some forms of denial-of-service attacks.
Check Content
To view the LimitRequestLine value enter the following command: find / -name httpd.conf -print -exec grep -H -i "LimitRequestLine" {} \; If the value of LimitRequestLine is not set to 8190, this is a finding. If no LimitRequestLine directives exist, this is a finding. Although the default value is 8190, this directive must be explicitly set.
Fix Text
Edit the httpd.conf file and set the LimitRequestLine directive to 8190 or other approved value, add the directive if it does not exist.
Additional Identifiers
Rule ID:
Vulnerability ID: V-13739
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
No CCIs are assigned to this check |
Controls
Number | Title |
---|---|
No controls are assigned to this check |