Only newest Apache log WebDAV exploit requests?

After upgrade Apache from 2.0.48 to 2.0.49, I received large amount of
WebDAV exploit requests
(like "SEARCH
\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02......")
(>500 entries in 3 days).

Then i degrade to 2.0.48, the requests disappeared.

So, only Apache 2.0.49/1.3.29 log these requests, is that true? And
why?



--
jason.gao
------------------------------------------------------------------------
Posted via http://www.webservertalk.com
------------------------------------------------------------------------
View this thread: http://www.webservertalk.com/message179081.html

jason.gao wrote:

 > WebDAV exploit requests

 > So, only Apache 2.0.49/1.3.29 log these requests, is that true?

No, this is not true. Any version which drops a connection
based on a 414 error, contains this bug. It might be 2.0.49
accepts a SEARCH request method. However, I would expect
this same bug to appear if that version drops a connection
based on a 414 error; URI length over eight kilobytes.


 > why?

Visually examine your Apache httpd.h header file
for c++ compilation, found in your include directory,
about half way through,

define ap_status_drops_connection

There and subsequent lines and sections you
will discover why Webdav exploits are able
to make use of this bug in Apache.

Most direct cure is to rewrite the httpd.h header file
and associated header files to remove a 414 from the
drop connection array, then allow SEARCH as a recognized
method, then recompile Apache.

There is an inherent problem, this defeats the URI length
filter allowing the entire Webdav exploit to enter.
Better approach would be to write code which scans
a request for "SEARCH" and immediately drops a connection
with no further processing.

Apache should drop a connection based on an unrecognized
request method, but does not. This is a bug which leads
to a series of subsequent bugs.

I would suggest a reader not try this unless you
are quite experienced in C language and equally
experienced at compiling Apache.


Purl Gurl<!-- ~MESSAGE_AFTER~ -->