PT-2011-1355

Name of the Vulnerable Software and Affected Versions GoAhead WebServer affected versions not specified Description The issue allows remote attackers to cause a denial of service, resulting in a daemon outage, via partial HTTP requests. This can be demonstrated using tools like Slowloris, which c...

CVE-2009-5111: Undefined Security Weakness

GoAhead WebServer allows remote attackers to cause a denial of service daemon outage via partial HTTP requests, as demonstrated by Slowloris...

CVE-2007-6750: Undefined Security Weakness

The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service daemon outage via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the modreqtimeout module in versions before 2.2.15...

SOL12636 - Slowloris denial-of-service attack vulnerability CVE-2007-6750

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version...

Apache 2.2.x < 2.2.15 Multiple Vulnerabilities

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.15. It is, therefore, potentially affected by multiple vulnerabilities : - A TLS renegotiation prefix injection attack is possible. CVE-2009-3555 - The 'modproxyajp' module returns the wrong status cod...

Partial HTTP Requests Denial of Service

Slowloris is a HTTP Denial of Service tool written in PERL. This is how the tool works: The tool sends an HTTP request with a partial header. The server will open the connection and wait for the complete header to be received. However, the DoS tool will not send it and will instead keep sending...

Robert "Rsnake" Hansen On Slowloris, DoS Attacks And RFC-1918 Networks

Dennis Fisher talks with Robert “Rsnake” Hansen about his Slowloris tool, low-bandwidth DoS attacks and the law of unintended consequences. Download SHOW NOTES: Mitigating the Slowloris HTTP DoS Attack New attack class exploits intranet weaknesses Subscribe to the Digital Underground podcast on...

Mitigating the Slowloris HTTP DoS Attack

Enterprise IT security staffs looking for some mitigation for the newly released HTTP DoS tool may have a few options. The analysts at the SANS Internet Storm Center are recommending that organizations running Web servers that are vulnerable to the tool’s attack make some basic configuration...

Slowloris Denial of Service Attack

Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to-but never completing-the...