Re: [us...@httpd] Apache 1.x & 2.x vulnerability against simple DoS attacks

2009-06-23 Thread Damian Myerscough
Hello, Mod_evasive is unable to defend against this attack. 2009/6/23 Tom Evans : > On Tue, 2009-06-23 at 16:36 +0100, Damian Myerscough wrote: >> Hello, >> >> >> Isn't the 'event MPM' experimental? >> >> >> Wouldn't 'worker MPM' work better? >> >> 2009/6/23 Tom Evans >>         On Tue, 2009-06-

Re: [us...@httpd] Apache 1.x & 2.x vulnerability against simple DoS attacks

2009-06-23 Thread Tom Evans
On Tue, 2009-06-23 at 16:36 +0100, Damian Myerscough wrote: > Hello, > > > Isn't the 'event MPM' experimental? > > > Wouldn't 'worker MPM' work better? > > 2009/6/23 Tom Evans > On Tue, 2009-06-23 at 15:11 +0200, Bastien LEGRAS wrote: > > Hi, > > > > I just tr

Re: [us...@httpd] Apache 1.x & 2.x vulnerability against simple DoS attacks

2009-06-23 Thread Damian Myerscough
Hello, Isn't the 'event MPM' experimental? Wouldn't 'worker MPM' work better? 2009/6/23 Tom Evans > On Tue, 2009-06-23 at 15:11 +0200, Bastien LEGRAS wrote: > > Hi, > > > > I just tried the perl script against my 2.2 apache under ubuntu 8.04 > > and found I could make my apache server unavailab

Re: [us...@httpd] Apache 1.x & 2.x vulnerability against simple DoS attacks

2009-06-23 Thread Tom Evans
On Tue, 2009-06-23 at 15:11 +0200, Bastien LEGRAS wrote: > Hi, > > I just tried the perl script against my 2.2 apache under ubuntu 8.04 > and found I could make my apache server unavailable in 30 sec with the > little hack script you can find here http://ha.ckers.org/slowloris/ > > Has anyone hea

[us...@httpd] Apache 1.x & 2.x vulnerability against simple DoS attacks

2009-06-23 Thread Bastien LEGRAS
Hi, I just tried the perl script against my 2.2 apache under ubuntu 8.04 and found I could make my apache server unavailable in 30 sec with the little hack script you can find here http://ha.ckers.org/slowloris/ Has anyone heard of a configuration or a ongoing fix to protect Apache against such a