latest Apache struts security issue

[fuzzy17]

We don't run Snort, so is there a way to block cmd.exe in a header with Apache 2.2 (I know we are on IBM HTTP Server, which is based on 2.2)?

[isc.sans.edu...]

[fuzzy17]

Well,I think

RewriteCond "%{Content-Type}" "*.cmd.*"
RewriteRule .* - [F]

[engine]

Was it this one? [webmasterworld.com...]

[phranque]

Was it this one?

yes, that's the same exploit.

there are additional solutions/workarounds mentioned in the apache.org article referenced in that other thread.