Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Created attachment 542333[details]
binary file, is a remote exploit for apache server.
Description of problem:
Really i no have RHEL, i use Scientific Linux 6.1 stable, 32 an 64 bit, and both have the same bug (tested in others distros), and launching the exploit, generate in the remote host, a overload in apache, and DoS while the exploit are running in the attacker
Version-Release number of selected component (if applicable):
apache 2.2.15
How reproducible:
launch the exploit, i no have the source code because the author, no show the source code is not a security researcher, is a black hat boy
Steps to Reproduce:
1.download the binary file
2../rapache host
3.
Actual results:
Apache crash while the exploit is running
Expected results:
Additional info:
Attach the binary file, downloaded from:
http://myw1sd0m.blogspot.com/2011/09/remote-apache-denial-of-service-exploit.htmlhttp://jayakonstruksi.com/backupintsec/rapache.tgz
bug found by : Nikolaus Rango (Kingcope)
sploit coded by : ev1lut10n
evllut10n's email : ev1lut10n_exploit
ev1lut10n's gopher : gopher://sdf.org/1/users/ev1lut10
thanks to: X-hack, Danzel, superman,flyff666,peneter,wenkhairu, fadli,gunslinger,petimati,net_spy, and all my friends and you !
=================
root@ev1l:/home/ev1lut10n# ./rapache
Remote Apache Denial of Service Exploit by ev1lut10n
[-] Usage : ./rapache hostname
root@ev1l:/home/ev1lut10n#
===================
===========
affected:
Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19
Actually, my host, log during attack:
in /var/log/httpd/access_log:
::1 - - [07/Dec/2011:22:29:50 -0300] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [07/Dec/2011:22:29:51 -0300] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [07/Dec/2011:22:29:52 -0300] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
the internal dummy connection is present when the exploit is stoped, during the exploit the message is:
[07/Dec/2011:23:31:35 -0300] "HEAD / HTTP/1.1" 400 - "-" "-"