Re: [Full-disclosure] Apache Killer

["HI-TECH ." <isowarez.isowarez.isowarez@xxxxxxxxxxxxxx>]

Yeah you are correct. It does not really matter.
It's just a DoS things should move on.
I do that for fun, seeing things break, not more not less,
the hype on the media right now makes no difference, but
I must admit listening to Johannes Ullrich in the daily stormcast reporting
about the postings is quite fun.

2011/8/25 Michal Zalewski <lcamtuf@xxxxxxxxxxx>:
>> just for the record I have the impression that this not the same 
>> vulnerability
>> you outlined in your advisory a while back. It is more that the idea
>> for this vulnerability originated from your advisory, not the same bug.
>
> I don't think this even matters, and I really don't disagree...
>
> In 2007, I noticed that their Range handling is silly, and may prompt
> them to generate very large responses.
>
> I casually proposed a window scaling-based attack back then, and
> nothing happened.
>
> My understanding is that your exploit is based on the same principle
> (I don't think they fixed this in any way), but combines it with
> protocol-level compression to force the server to waste some memory
> and CPU resources to compress the response beforehand.
>
> But in any case, life goes on, it's just a DoS. Good that they're fixing it...
>
> /mz
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/