News for hackers. Stuff that matters.

A comment on Optionsbleed – HTTP OPTIONS method can leak Apache's server memory. Parent comment

Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by hannob on Monday September 18, 2017 @11:25AM (#15276720)
Apache is the standard solution in web hosting.

Its "killer feature" are htaccess files. It provides a possibility to give users a limited way to configure their virtual hosts, without giving them too much power. (Unfortunately there are some unfixed systemic security issues with that, namely symlink attacks...)

[ Parent | on HN ]
Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by sk5t on Monday September 18, 2017 @02:10PM (#15278120)
I'd imagine one could crush the server with pathological rewrite regexps too.
[ Parent | on HN ]
Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by hannob on Monday September 18, 2017 @02:41PM (#15278375)
You can, and it's very unfortunate that the apache devs don't consider these things vulnerabilities. (I reported a DoS via password hashes a while ago.)
[ Parent | on HN ]