Top ASX-listed companies vulnerable to Apache DoS exploit

Powered by SC Magazine
 

Attack launched over 3G

Twenty six of the top 200 ASX-listed companies are vulnerable to an Apache web server denial of service exploit according to a penetration testing company.

The exploit issues partial content requests to Apache httpd which causes the daemon to swap memory to the file system, eventually triggering a denial of service attack

The attack was released by researcher Kingcope on the Full Disclosure mailing list.

HackLabs director Chris Gatford tested the exploit and found it could work over a 3G mobile connection.

"We edited the exploit script and removed the DoS (Denial of Service) payload and then used it determine how many sites could be affected," Gatford said.

Gatford said 91 of the top 1000 Australian sites listed by Alexa appeared vulnerable to the exploit.

HackLabs said firewalls, intrusion prevention systems or IP table rules could be used to mitigate the attack.

Curl can be run to test exposure to the attack by determining if partial content is supported on by Apache;

curl -H "Range:bytes=1-" -I http://target.com | grep Partial

Apply a patch to add support to turn off partial content.

Copyright © SC Magazine, Australia


Top ASX-listed companies vulnerable to Apache DoS exploit
Tags
 
 
 
Top Stories
Myer CIO named retailer's new chief executive
Richard Umbers to lead data-driven retail strategy.
 
Empty terminals and mountains of data
Qantas CIO Luc Hennekens says no-one is safe from digital disruption.
 
BoQ takes $10m hit on Salesforce CRM
Regulatory hurdles end cloud pilot.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  35%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 4065

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 1390

Vote