[Full-disclosure] Apache Killer

[HI-TECH .]

Yeah you are correct. It does not really matter.
It's just a DoS things should move on.
I do that for fun, seeing things break, not more not less,
the hype on the media right now makes no difference, but
I must admit listening to Johannes Ullrich in the daily stormcast reporting
about the postings is quite fun.

2011/8/25 Michal Zalewski <lcamtuf at coredump.cx>:
>> just for the record I have the impression that this not the same vulnerability
>> you outlined in your advisory a while back. It is more that the idea
>> for this vulnerability originated from your advisory, not the same bug.
>
> I don't think this even matters, and I really don't disagree...
>
> In 2007, I noticed that their Range handling is silly, and may prompt
> them to generate very large responses.
>
> I casually proposed a window scaling-based attack back then, and
> nothing happened.
>
> My understanding is that your exploit is based on the same principle
> (I don't think they fixed this in any way), but combines it with
> protocol-level compression to force the server to waste some memory
> and CPU resources to compress the response beforehand.
>
> But in any case, life goes on, it's just a DoS. Good that they're fixing it...
>
> /mz
>