QID 730218

Date Published: 2021-10-06

QID 730218: Apache Hypertext Transfer Protocol Server (HTTP Server) Denial of Service (DoS) Vulnerability

The Apache HTTP Server, commonly referred to as Apache is a freely available Web server.

Apache is vulnerable to a denial of service due to holding a connection open for partial HTTP requests.

Apache Versions 1.x and 2.x prior to version 2.2.15 are vulnerable.

A remote attacker can cause a denial of service against the Web server which would prevent legitimate users from accessing the site.

Denial of service tools and scripts such as Slowloris takes advantage of this vulnerability.

  • CVSS V2 rated as Medium - 5 severity.
    • Solution
    Customers are advised to update to Apache HTTP Server 2.2.15 or later. For more information refer to Apache HTTP Server Download page

    Workaround:
    - Server-specific recommendations can be found here.

    - Countermeasures for Apache are described here.

    - Reverse proxies, load balancers and iptables can help to prevent this attack from occurring.

    - Adjusting the TimeOut Directive can also prevent this attack from occurring.

    - A new module mod_reqtimeout has been introduced since Apache 2.2.15 to provide tools for mitigation against these forms of attack.

    Also refer to Cert Blog and Slowloris and Mitigations for Apache document for further information.

    Vendor References

    CVEs related to QID 730218

    CVE-2007-6750 |
    Software Advisories
    Advisory ID Software Component Link
    NA URL Logo httpd.apache.org/download.cgi#apache24
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].