The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.

The version of macOS Server (formerly known as Mac OS X Server) installed on the remote host is prior to 5.3. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the Apache     HTTP server when handling a saturation of partial HTTP     requests. An unauthenticated, remote attacker can     exploit this to crash the daemon. (CVE-2007-6750)

  - A denial of service vulnerability exists in Action Pack     in Ruby on Rails due to improper restrictions on the use     of the MIME type cache when handling specially crafted     HTTP accept headers. An unauthenticated, remote attacker     can exploit this to cause the cache to grow     indefinitely. (CVE-2016-0751)

  - An information disclosure vulnerability exists in the     Wiki Server component due to improper checking of     unspecified permissions. An unauthenticated, remote can     exploit this to enumerate users. (CVE-2017-2382)

The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15. (CVE-2007-6750)

Impact

The Slowloris attack is a type of denial-of-service (DoS) attack that targets threaded web servers. It attempts to monopolize all of the available request handling threads on the web server by sending HTTP requests that never complete. Because each request consumes a thread, the Slowloris attack eventually consumes all of the web server's connection capacity, effectively denying access to legitimate users.

The HTTP protocol specification Internet Engineering Task Force (RFC 2616) states that a blank line must be used to indicate the end of the request headers and the beginning of the payload, if any. After the entire request is received, the web server may then respond.

Note : A blank line is created by sending two consecutive newlines :

<CR><LF><CR><LF>

The Slowloris attack operates by establishing multiple connections to the web server. On each connection, it sends an incomplete request that does not include the terminating newline sequence. The attacker sends additional header lines periodically to keep the connection alive, but never sends the terminating newline sequence. The web server keeps the connection open, expecting more information to complete the request. As the attack continues, the volume of long-standing Slowloris connections increases, eventually consuming all available web server connections, thus rendering the web server unavailable to respond to legitimate requests.

According to its banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the Apache     HTTP Server due to the lack of the mod_reqtimeout     module. An unauthenticated, remote attacker can exploit     this, via a saturation of partial HTTP requests, to     cause a daemon outage. (CVE-2007-6750)

  - A cross-site scripting (XSS) vulnerability exists in     jQuery when using location.hash to select elements. An     unauthenticated, remote attacker can exploit this, via     a specially crafted tag, to inject arbitrary script     code or HTML into the user's browser session.
    (CVE-2011-4969)

  - A NULL pointer dereference flaw exists in file     rsa_ameth.c due to improper handling of ASN.1 signatures     that are missing the PSS parameter. A remote attacker     can exploit this to cause the signature verification     routine to crash, resulting in a denial of service     condition. (CVE-2015-3194)

  - A flaw exists in the ASN1_TFLG_COMBINE implementation in     file tasn_dec.c related to handling malformed     X509_ATTRIBUTE structures. A remote attacker can exploit     this to cause a memory leak by triggering a decoding     failure in a PKCS#7 or CMS application, resulting in a     denial of service. (CVE-2015-3195)

  - An out-of-bounds read error exists in cURL and libcurl     within the smb_request_state() function due to improper     bounds checking. An unauthenticated, remote attacker     can exploit this, using a malicious SMB server and     crafted length and offset values, to disclose sensitive     memory information or to cause a denial of service     condition. (CVE-2015-3237)

  - A flaw exists in libxslt in the xsltStylePreCompute()     function within file preproc.c due to a failure to check     if the parent node is an element. An unauthenticated,     remote attacker can exploit this, via a specially     crafted XML file, to cause a denial of service     condition. (CVE-2015-7995)

  - An infinite loop condition exists in the xz_decomp()     function within file xzlib.c when handling xz compressed     XML content due to a failure to detect compression     errors. An unauthenticated, remote attacker can exploit     this, via specially crafted XML data, to cause a denial     of service condition. (CVE-2015-8035)

  - A double-free error exists due to improper validation of     user-supplied input when parsing malformed DSA private     keys. A remote attacker can exploit this to corrupt     memory, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2016-0705)

  - An out-of-bounds read error exists in the fmtstr()     function within file crypto/bio/b_print.c when printing     very long strings due to a failure to properly calculate     string lengths. An unauthenticated, remote attacker can     exploit this, via a long string, to cause a denial of     service condition, as demonstrated by a large amount of     ASN.1 data. (CVE-2016-0799)

  - An unspecified flaw exists that allows a local attacker     to impact the confidentiality and integrity of the     system. No other details are available. (CVE-2016-2015)

  - A flaw exists in the doapr_outch() function within file     crypto/bio/b_print.c due to a failure to verify that a     certain memory allocation succeeds. An unauthenticated,     remote attacker can exploit this, via a long string,     to cause a denial of service condition, as demonstrated     by a large amount of ASN.1 data. (CVE-2016-2842)

The remote IBM Storwize device is running a version that is 1.3.x prior to 1.4.3.4 or 1.5.x prior to 1.5.0.2. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists due to a flaw     in the bundled version of Apache HTTP Server. A remote     attacker can exploit this, via partial HTTP requests,     to cause a daemon outage, resulting in a denial of     service condition. (CVE-2007-6750)

  - An HTTP request smuggling vulnerability exists due to a     flaw in the bundled version of Apache Tomcat; when an     HTTP connector or AJP connector is used, Tomcat fails to     properly handle certain inconsistent HTTP request     headers. A remote attacker can exploit this flaw, via     multiple Content-Length headers or a Content-Length     header and a 'Transfer-Encoding: chunked' header, to     smuggle an HTTP request in one or more Content-Length     headers. (CVE-2013-4286)

  - A denial of service vulnerability exists in the bundled     version of Apache Tomcat due to improper processing of     chunked transfer coding with a large amount of chunked     data or whitespace characters in an HTTP header value     within a trailer field. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2013-4322)

  - A denial of service vulnerability exists due to a flaw     in the bundled version of Apache Tomcat; an integer     overflow condition exists in the parseChunkHeader()     function in ChunkedInputFilter.java. A remote attacker     can exploit this, via a malformed chunk size that is     part of a chunked request, to cause excessive     consumption of resources, resulting in a denial of     service condition. (CVE-2014-0075)

  - A remote code execution vulnerability exists due to a     flaw in the bundled version of Apache Struts. A remote     attacker can manipulate the ClassLoader via the class     parameter, resulting in the execution of arbitrary Java     code. (CVE-2014-0094)

  - An XML External Entity (XXE) injection vulnerability     exists due to a flaw in the bundled version of Apache     Tomcat; an incorrectly configured XML parser accepts     XML external entities from an untrusted source via XSLT.
    A remote attacker can exploit this, by sending specially     crafted XML data, to gain access to arbitrary files.
    (CVE-2014-0096)

  - An integer overflow condition exists in the bundled     version of Apache Tomcat. A remote attacker, via a     crafted Content-Length HTTP header, can conduct HTTP     request smuggling attacks. (CVE-2014-0099)

  - An information disclosure vulnerability exists due to a     flaw in the bundled version of Apache Tomcat. Tomcat     fails to properly constrain the class loader that     accesses the XML parser used with an XSLT stylesheet. A     remote attacker can exploit this, via a crafted web     application that provides an XML external entity     declaration in conjunction with an entity reference, to     read arbitrary files. (CVE-2014-0119)

  - A flaw exists in a bundled version of Samba due to a     flaw in the vfswrap_fsctl() function that is triggered     when responding to FSCTL_GET_SHADOW_COPY_DATA or     FSCTL_SRV_ENUMERATE_SNAPSHOTS client requests. An     unauthenticated, remote attacker can exploit this, via     a specially crafted request, to disclose sensitive     information from process memory. (CVE-2014-0178)

  - Multiple flaws exist in the bundled version of Mozilla     Firefox that allow a remote attacker to execute     arbitrary code. (CVE-2014-1555, CVE-2014-1556,     CVE-2014-1557)

  - An information disclosure vulnerability exists due to     the chkauth password being saved in plaintext in the     audit log. A local attacker can exploit this to gain     administrator access. (CVE-2014-3077)

  - A denial of service vulnerability exists due to a flaw     in the bundled version of Samba. An authenticated,     remote attacker can exploit this, via an attempt to read     a Unicode pathname without specifying the use of     Unicode, to cause an application crash. (CVE-2014-3493)   
  - A security bypass vulnerability exists due to an     unspecified flaw. A remote attacker can exploit this     flaw to reset the administrator password to its default     value via a direct request to the administrative IP     address. Note that this vulnerability only affects the     1.4.x release levels. (CVE-2014-4811)

This Apache2 LTSS roll-up update for SUSE Linux Enterprise 10 SP3 LTSS fixes the following security issues and bugs :

  - CVE-2012-4557: Denial of Service via special requests in     mod_proxy_ajp

  - CVE-2012-0883: improper LD_LIBRARY_PATH handling

  - CVE-2012-2687: filename escaping problem

  - CVE-2012-0031: Fixed a scoreboard corruption (shared mem     segment) by child causes crash of privileged parent     (invalid free()) during shutdown.

  - CVE-2012-0053: Fixed an issue in error responses that     could expose 'httpOnly' cookies when no custom     ErrorDocument is specified for status code 400'.

  - The SSL configuration template has been adjusted not to     suggested weak ciphers CVE-2007-6750: The     'mod_reqtimeout' module was backported from Apache     2.2.21 to help mitigate the 'Slowloris' Denial of     Service attack.

    You need to enable the 'mod_reqtimeout' module in your     existing apache configuration to make it effective, e.g.
    in the APACHE_MODULES line in /etc/sysconfig/apache2.

  - CVE-2011-3639, CVE-2011-3368, CVE-2011-4317: This update     also includes several fixes for a mod_proxy reverse     exposure via RewriteRule or ProxyPassMatch directives.

  - CVE-2011-1473: Fixed the SSL renegotiation DoS by     disabling renegotiation by default.

  - CVE-2011-3607: Integer overflow in ap_pregsub function     resulting in a heap-based buffer overflow could     potentially allow local attackers to gain privileges

Additionally, some non-security bugs have been fixed which are listed in the changelog file.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of apache2 fixes regressions and several security problems :

bnc#728876, fix graceful reload

bnc#741243, CVE-2012-0031: Fixed a scoreboard corruption (shared mem segment) by child causes crash of privileged parent (invalid free()) during shutdown.

bnc#743743, CVE-2012-0053: Fixed an issue in error responses that could expose 'httpOnly' cookies when no custom ErrorDocument is specified for status code 400'.

bnc#738855, CVE-2007-6750: The 'mod_reqtimeout' module was backported from Apache 2.2.21 to help mitigate the 'Slowloris' Denial of Service attack.

You need to enable the 'mod_reqtimeout' module in your existing apache configuration to make it effective, e.g. in the APACHE_MODULES line in /etc/sysconfig/apache2.

- httpd-2.2.x-bnc743743-CVE-2012-0053-server_protocol_c-cookie_exposure.diff addresses CVE-2012-0053: error responses can expose cookies when no custom 400 error code ErrorDocument is configured. [bnc#743743]

- httpd-2.2.x-bnc741243-CVE-2012-0031-scoreboard_handling.diff:
scoreboard corruption   (shared mem segment) by child causes crash of privileged parent (invalid free()) during shutdown.
This is rated low impact. Notice:
https://svn.apache.org/viewvc?view=revision&revision=1230065 makes a change to the struct global_score, which causes binary incompatibility. The change in above patch only goes as far as the binary compatibility allows; the vulnerability is completely fixed, though. CVE-2012-0031 [bnc#741243]

  - /etc/init.d/apache2: new argument 'check-reload'. Exits     1 if httpd2 runs on deleted binaries such as after     package update, else 0. This is used by equally modified     /etc/logrotate.d/apache2, which uses     '/etc/init.d/apache2 check-reload' in its prerotate     script. These changes prevent httpd2 from being     (gracefully) reloaded by logrotate, executed by cron, if     new binaries have been installed. Instead, a warning is     printed on stdout and is being logged to the syslogs. If     this happens, apache's logs are NOT rotated, and the     running processes are left untouched. This limits the     maximum damage of log rotation to unrotated logs.
    '/etc/init.d/apache2 restart' (or 'rcapache2 restart')     must be executed manually in such a case. [bnc#728876]

- httpd-2.2.x-bnc729181-CVE-2011-3607-int_overflow.diff: Fix for integer overflow in server/util.c also known as CVE-2011-3607.
[bnc#729181]

  - enable build and configuration of mod_reqtimeout.c     module by default in /etc/sysconfig/apache2     (APACHE_MODULES=...). This does not change already     existing sysconfig files, the module is only activated     via sysconfig if this package is installed without     pre-existing sysconfig file. See new file     /etc/apache2/mod_reqtimeout.conf for configurables.
    Helps against Slowloris.pl DoS vulnerability that     consists of eating up request slots by very slowly     submitting the request. Note that mod_reqtimeout limits     requests based on a lower boundary of request speed, not     an upper boundary! CVE-2007-6750 [bnc#738855].

The remote host is affected by the vulnerability described in GLSA-201309-12 (Apache HTTP Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Apache HTTP Server. Please       review the CVE identifiers and research paper referenced below for       details.
  Impact :

    A remote attacker could send a specially crafted request to possibly       execute arbitrary code, cause Denial of Service, or obtain sensitive       information.
  Workaround :

    There is no known workaround at this time.

This update of apache fixes regressions and several security problems :

  - Fixed a scoreboard corruption (shared mem segment) by     child causes crash of privileged parent (invalid free())     during shutdown. (bnc#741243, CVE-2012-0031)

  - Fixed an issue in error responses that could expose     'httpOnly' cookies when no custom ErrorDocument is     specified for status code 400'.
    (bnc#743743,CVE-2012-0053)

  - the SSL configuration template suggested weak ciphers.
    (bnc#736706)

  - The 'mod_reqtimeout' module was backported from Apache     2.2.21 to help mitigate the 'Slowloris' Denial of     Service attack. (bnc#738855,CVE-2007-6750)

    You need to enable the 'mod_reqtimeout' module in your     existing apache configuration to make it effective, e.g.
    in the APACHE_MODULES line in /etc/sysconfig/apache2.

This update of apache2 and libapr1 fixes regressions and several security problems.

  - Fixed a scoreboard corruption (shared mem segment) by     child causes crash of privileged parent (invalid free())     during shutdown. (CVE-2012-0031)

  - Fixed an issue in error responses that could expose     'httpOnly' cookies when no custom ErrorDocument is     specified for status code 400'. (CVE-2012-0053)

  - The 'mod_reqtimeout' module was backported from Apache     2.2.21 to help mitigate the 'Slowloris' Denial of     Service attack. You need to enable the 'mod_reqtimeout'     module in your existing apache configuration to make it     effective, e.g. in the APACHE_MODULES line in     /etc/sysconfig/apache2. For more detailed information,     check also the README file. (CVE-2007-6750)

Also the following bugs have been fixed :

  - Fixed init script action 'check-reload' to avoid     potential crashes. (bnc#728876)

  - An overlapping memcpy() was replaced by memmove() to     make this work with newer glibcs. (bnc#738067 /     bnc#741874)

  - libapr1: reset errno to zero to not return previous     value despite good status of new operation. (bnc#739783)

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.15. It is, therefore, potentially affected by multiple vulnerabilities :

  - A TLS renegotiation prefix injection attack is possible.     (CVE-2009-3555)

  - The 'mod_proxy_ajp' module returns the wrong status code     if it encounters an error which causes the back-end     server to be put into an error state. (CVE-2010-0408)

  - The 'mod_isapi' attempts to unload the 'ISAPI.dll' when     it encounters various error states which could leave     call-backs in an undefined state. (CVE-2010-0425)

  - A flaw in the core sub-request process code can lead to     sensitive information from a request being handled by     the wrong thread if a multi-threaded environment is     used. (CVE-2010-0434)

  - Added 'mod_reqtimeout' module to mitigate Slowloris     attacks. (CVE-2007-6750)

ID	Name	Product	Family	Severity
99128	macOS : macOS Server < 5.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
97419	F5 Networks BIG-IP : Slowloris denial-of-service attack vulnerability (K12636)	Nessus	F5 Networks Local Security Checks	medium
91222	HP System Management Homepage Multiple Vulnerabilities (HPSBMU03593)	Nessus	Web Servers	critical
84401	IBM Storwize 1.3.x < 1.4.3.4 / 1.5.x < 1.5.0.2 Multiple Vulnerabilities	Nessus	Misc.	high
83578	SUSE SLES10 Security Update : apache2 (SUSE-SU-2013:0469-1)	Nessus	SuSE Local Security Checks	medium
75789	openSUSE Security Update : apache2-201202 (openSUSE-SU-2012:0314-1)	Nessus	SuSE Local Security Checks	medium
74555	openSUSE Security Update : apache2 (openSUSE-2012-132)	Nessus	SuSE Local Security Checks	medium
70085	GLSA-201309-12 : Apache HTTP Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
58166	SuSE 10 Security Update : Apache2 (ZYPP Patch Number 7972)	Nessus	SuSE Local Security Checks	medium
58030	SuSE 11.1 Security Update : Apache2 (SAT Patch Number 5760)	Nessus	SuSE Local Security Checks	medium
45004	Apache 2.2.x < 2.2.15 Multiple Vulnerabilities	Nessus	Web Servers	critical

Detections

Analytics

CVE-2007-6750

critical

Tenable Plugins

high

medium

critical

high

medium

medium

medium

medium

medium

medium

critical