Ensure the LimitRequestLine directive is Set to 8190 or less but not 0

BajaNivel 2Automatizadaapache

Descripción

Buffer Overflow attacks attempt to exploit an application by providing more data than the application buffer can contain. If the application allows copying data to the buffer to overflow the boundaries of the buffer, then the application is vulnerable to a buffer overflow. LimitRequestLine must be set and every value must be 1-8190. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Cómo se verifica

Método de auditoría: Comando de shell

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="limitrequestline"{n++; v=$2+0; if(!(v>=1 && v<=8190)) bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set LimitRequestLine 8190 (or lower, not 0). Then run apachectl configtest and reload Apache.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: apacherequest-limits
Referencia: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 10.1 Ensure the LimitRequestLine directive is Set to 8190 or less but not 0

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target apache --level 2