[Full-disclosure] IPS Evasion with the Apache HTTP Server

[coderman]

On 6/19/07, Valdis.Kletnieks at vt.edu <Valdis.Kletnieks at vt.edu> wrote:
> ...
> I'm tempted to take that bet.  Lot of people have thrown lots of truly wild
> stuff at the Apache code over the years - it may react in *unexpected* ways,
> but it's probably pretty bulletproof.

agreed.


> On the other hand, that little webserver admin tool that's stuffed into one
> corner of your DSL modem's ROM probably got tested ... with little to no
> serious abuse of the interface.

absolutely.  i didn't mean to imply that embedded and lightweight
webservers were more robust, they surely aren't.  only that they would
be much less likely to interpret arbitrary unprintable characters in a
request as valid.

in particular, buffer overflows are not uncommon for embedded devices,
like those who don't expect a request URL to exceed 1024 characters,
etc...