local http = require "http"

local shortport = require "shortport"

local stdnse = require "stdnse"

local vulns = require "vulns"

description = [[

Detects a denial of service vulnerability in the way the Apache web server

handles requests for multiple overlapping/simple ranges of a page.

References:

* http://seclists.org/fulldisclosure/2011/Aug/175

* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192

* http://nessus.org/plugins/index.php?view=single&id=55976

]]

---

-- @usage

-- nmap --script http-vuln-cve2011-3192.nse [--script-args http-vuln-cve2011-3192.hostname=nmap.scanme.org] -pT:80,443 <host>

--

-- @output

-- Host script results:

-- | http-vuln-cve2011-3192:

-- | VULNERABLE:

-- | Apache byterange filter DoS

-- | State: VULNERABLE

-- | IDs: CVE:CVE-2011-3192 OSVDB:74721

-- | Description:

-- | The Apache web server is vulnerable to a denial of service attack when numerous

-- | overlapping byte ranges are requested.

-- | Disclosure date: 2011-08-19

-- | References:

-- | http://seclists.org/fulldisclosure/2011/Aug/175

-- | http://nessus.org/plugins/index.php?view=single&id=55976

-- | http://osvdb.org/74721

-- |_ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192

--

-- @args http-vuln-cve2011-3192.hostname Define the host name to be used in the HEAD request sent to the server

-- @args http-vuln-cve2011-3192.path Define the request path

-- changelog

-- 2011-08-29 Duarte Silva <[email protected]>

-- - Removed the "Accept-Encoding" HTTP header

-- - Removed response header printing

-- * Changes based on Henri Doreau and David Fifield sugestions

-- 2011-08-20 Duarte Silva <[email protected]>

-- * First version ;)

-- 2011-11-07 Henri Doreau

-- * Use the vulns library to report results

-----------------------------------------------------------------------

author = "Duarte Silva <[email protected]>"

license = "Same as Nmap--See http://nmap.org/book/man-legal.html"

categories = {"vuln", "safe"}

portrule = shortport.http

action = function(host, port)

end