CVE-2007-6750 The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeo...
MediumCVSS 5.0
EPSS 70.5%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/apache2(Debian:12) | < 2.2.15-3 | 2.2.15-3 |
| debian/apache2(Debian:13) | < 2.2.15-3 | 2.2.15-3 |
| debian/apache2(Debian:14) | < 2.2.15-3 | 2.2.15-3 |
| Apache HTTP Server | <= 2.2.14 | No fix listed |
| Apache HTTP Server | = 1.0 | No fix listed |
| Apache HTTP Server | = 1.0.2 | No fix listed |
| Apache HTTP Server | = 1.0.3 | No fix listed |
| Apache HTTP Server | = 1.0.5 | No fix listed |
| Apache HTTP Server | = 1.1 | No fix listed |
| Apache HTTP Server | = 1.1.1 | No fix listed |
| Apache HTTP Server | = 1.2 | No fix listed |
| Apache HTTP Server | = 1.2.4 | No fix listed |
| Apache HTTP Server | = 1.2.5 | No fix listed |
| Apache HTTP Server | = 1.2.6 | No fix listed |
| Apache HTTP Server | = 1.2.9 | No fix listed |
| Apache HTTP Server | = 1.3 | No fix listed |
| Apache HTTP Server | = 1.3.0 | No fix listed |
| Apache HTTP Server | = 1.3.1 | No fix listed |
| Apache HTTP Server | = 1.3.1.1 | No fix listed |
| Apache HTTP Server | = 1.3.2 | No fix listed |
| Apache HTTP Server | = 1.3.3 | No fix listed |
| Apache HTTP Server | = 1.3.4 | No fix listed |
| Apache HTTP Server | = 1.3.5 | No fix listed |
| Apache HTTP Server | = 1.3.6 | No fix listed |
| Apache HTTP Server | = 1.3.7 | No fix listed |
Show 95 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | = 1.3.8 | No fix listed |
| Apache HTTP Server | = 1.3.9 | No fix listed |
| Apache HTTP Server | = 1.3.10 | No fix listed |
| Apache HTTP Server | = 1.3.11 | No fix listed |
| Apache HTTP Server | = 1.3.12 | No fix listed |
| Apache HTTP Server | = 1.3.13 | No fix listed |
| Apache HTTP Server | = 1.3.14 | No fix listed |
| Apache HTTP Server | = 1.3.15 | No fix listed |
| Apache HTTP Server | = 1.3.16 | No fix listed |
| Apache HTTP Server | = 1.3.17 | No fix listed |
| Apache HTTP Server | = 1.3.18 | No fix listed |
| Apache HTTP Server | = 1.3.19 | No fix listed |
| Apache HTTP Server | = 1.3.20 | No fix listed |
| Apache HTTP Server | = 1.3.22 | No fix listed |
| Apache HTTP Server | = 1.3.23 | No fix listed |
| Apache HTTP Server | = 1.3.24 | No fix listed |
| Apache HTTP Server | = 1.3.25 | No fix listed |
| Apache HTTP Server | = 1.3.26 | No fix listed |
| Apache HTTP Server | = 1.3.27 | No fix listed |
| Apache HTTP Server | = 1.3.28 | No fix listed |
| Apache HTTP Server | = 1.3.29 | No fix listed |
| Apache HTTP Server | = 1.3.30 | No fix listed |
| Apache HTTP Server | = 1.3.31 | No fix listed |
| Apache HTTP Server | = 1.3.32 | No fix listed |
| Apache HTTP Server | = 1.3.33 | No fix listed |
| Apache HTTP Server | = 1.3.34 | No fix listed |
| Apache HTTP Server | = 1.3.35 | No fix listed |
| Apache HTTP Server | = 1.3.36 | No fix listed |
| Apache HTTP Server | = 1.3.37 | No fix listed |
| Apache HTTP Server | = 1.3.38 | No fix listed |
| Apache HTTP Server | = 1.3.39 | No fix listed |
| Apache HTTP Server | = 1.3.41 | No fix listed |
| Apache HTTP Server | = 1.3.42 | No fix listed |
| Apache HTTP Server | = 1.3.65 | No fix listed |
| Apache HTTP Server | = 1.3.68 | No fix listed |
| Apache HTTP Server | = 1.4.0 | No fix listed |
| Apache HTTP Server | = 1.99 | No fix listed |
| Apache HTTP Server | = 2.0 | No fix listed |
| Apache HTTP Server | = 2.0.9 | No fix listed |
| Apache HTTP Server | = 2.0.28 | No fix listed |
| Apache HTTP Server | = 2.0.28-beta | No fix listed |
| Apache HTTP Server | = 2.0.32 | No fix listed |
| Apache HTTP Server | = 2.0.32-beta | No fix listed |
| Apache HTTP Server | = 2.0.34-beta | No fix listed |
| Apache HTTP Server | = 2.0.35 | No fix listed |
| Apache HTTP Server | = 2.0.36 | No fix listed |
| Apache HTTP Server | = 2.0.37 | No fix listed |
| Apache HTTP Server | = 2.0.38 | No fix listed |
| Apache HTTP Server | = 2.0.39 | No fix listed |
| Apache HTTP Server | = 2.0.40 | No fix listed |
| Apache HTTP Server | = 2.0.41 | No fix listed |
| Apache HTTP Server | = 2.0.42 | No fix listed |
| Apache HTTP Server | = 2.0.43 | No fix listed |
| Apache HTTP Server | = 2.0.44 | No fix listed |
| Apache HTTP Server | = 2.0.45 | No fix listed |
| Apache HTTP Server | = 2.0.46 | No fix listed |
| Apache HTTP Server | = 2.0.47 | No fix listed |
| Apache HTTP Server | = 2.0.48 | No fix listed |
| Apache HTTP Server | = 2.0.49 | No fix listed |
| Apache HTTP Server | = 2.0.50 | No fix listed |
| Apache HTTP Server | = 2.0.51 | No fix listed |
| Apache HTTP Server | = 2.0.52 | No fix listed |
| Apache HTTP Server | = 2.0.53 | No fix listed |
| Apache HTTP Server | = 2.0.54 | No fix listed |
| Apache HTTP Server | = 2.0.55 | No fix listed |
| Apache HTTP Server | = 2.0.56 | No fix listed |
| Apache HTTP Server | = 2.0.57 | No fix listed |
| Apache HTTP Server | = 2.0.58 | No fix listed |
| Apache HTTP Server | = 2.0.59 | No fix listed |
| Apache HTTP Server | = 2.0.60 | No fix listed |
| Apache HTTP Server | = 2.0.61 | No fix listed |
| Apache HTTP Server | = 2.0.63 | No fix listed |
| Apache HTTP Server | = 2.1 | No fix listed |
| Apache HTTP Server | = 2.1.1 | No fix listed |
| Apache HTTP Server | = 2.1.2 | No fix listed |
| Apache HTTP Server | = 2.1.3 | No fix listed |
| Apache HTTP Server | = 2.1.4 | No fix listed |
| Apache HTTP Server | = 2.1.5 | No fix listed |
| Apache HTTP Server | = 2.1.6 | No fix listed |
| Apache HTTP Server | = 2.1.7 | No fix listed |
| Apache HTTP Server | = 2.1.8 | No fix listed |
| Apache HTTP Server | = 2.1.9 | No fix listed |
| Apache HTTP Server | = 2.2 | No fix listed |
| Apache HTTP Server | = 2.2.0 | No fix listed |
| Apache HTTP Server | = 2.2.1 | No fix listed |
| Apache HTTP Server | = 2.2.2 | No fix listed |
| Apache HTTP Server | = 2.2.3 | No fix listed |
| Apache HTTP Server | = 2.2.4 | No fix listed |
| Apache HTTP Server | = 2.2.6 | No fix listed |
| Apache HTTP Server | = 2.2.8 | No fix listed |
| Apache HTTP Server | = 2.2.9 | No fix listed |
| Apache HTTP Server | = 2.2.10 | No fix listed |
| Apache HTTP Server | = 2.2.11 | No fix listed |
| Apache HTTP Server | = 2.2.12 | No fix listed |
| Apache HTTP Server | = 2.2.13 | No fix listed |
References
- Debian Security Tracker CVE-2007-6750 vendor-advisory
- bugs.debian.org issue-tracking
- 20070105 Re: a cheesy Apache / IIS DoS vuln (+a question) mailing-list
- ha.ckers.org
- openSUSE-SU-2012:0314 vendor-advisory
- SUSE-SU-2012:0323 vendor-advisory
- SSRT101139 vendor-advisory
- 21865 vdb-entry
- 1038144 vdb-entry
- apache-server-http-dos(72345) vdb-entry
- h20566.www2.hpe.com
- h20566.www2.hpe.com
- oval:org.mitre.oval:def:19481 signature vdb-entry