QID 730218

Date Published: 2021-10-06

QID 730218: Apache Hypertext Transfer Protocol Server (HTTP Server) Denial of Service (DoS) Vulnerability

The Apache HTTP Server, commonly referred to as Apache is a freely available Web server.

Apache is vulnerable to a denial of service due to holding a connection open for partial HTTP requests.

Apache Versions 1.x and 2.x prior to version 2.2.15 are vulnerable.

A remote attacker can cause a denial of service against the Web server which would prevent legitimate users from accessing the site.

Denial of service tools and scripts such as Slowloris takes advantage of this vulnerability.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to update to Apache HTTP Server 2.2.15 or later. For more information refer to Apache HTTP Server Download page

Workaround:
- Server-specific recommendations can be found here.

- Countermeasures for Apache are described here.

- Reverse proxies, load balancers and iptables can help to prevent this attack from occurring.

- Adjusting the TimeOut Directive can also prevent this attack from occurring.

- A new module mod_reqtimeout has been introduced since Apache 2.2.15 to provide tools for mitigation against these forms of attack.

Also refer to Cert Blog and Slowloris and Mitigations for Apache document for further information.

Vendor References

CVEs related to QID 730218

CVE-2007-6750 |

Software Advisories

Advisory ID	Software	Component	Link
NA			httpd.apache.org/download.cgi#apache24

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].