Slow Http Denial Of Service Attack Tomcat

  
Slow Http Denial Of Service Attack Tomcat

### Slow HTTP Denial of Service Attack `Medium` `Open` ##### Vulnerability description Your web server is vulnerable to Slow HTTP DoS (Denial of Service) attacks. Slowloris and Slow HTTP POST DoS attacks rely on the fact that the HTTP protocol, by design, requires requests to be completely received by the server before they are processed. Dec 24, 2019 Threat: The web application is possibly vulnerable to a 'slow HTTP POST' Denial of Service (DoS) attack. This is an application-level DoS that consumes server resources by maintaining open connections for an extended period of time by slowly sending traffic to the server. If an HTTP request is not complete, or if the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data. If the server keeps too many resources busy, this creates a denial of service. Consult Web references for information about protecting your. Slow HTTP attacks rely on the fact that the HTTP protocol, by design, requires requests to be completely received by the server before they are processed. If an http request is not complete, or if the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data.

Description

By sending a very long password (1.000.000 characters) it's possible to cause a denial a service attack on the server. This may lead to the website becoming unavailable or unresponsive. Usually this problem is caused by a vulnerable password hashing implementation. When a long password is sent, the password hashing process will result in CPU and memory exhaustion.
This vulnerability was detected by sending passwords with various lengths and comparing the measured response times. Consult details for more information.

Security Scan software hints JBoss has CVE-2007-6750 and CVE-2009-5111 security vulnerabilities (A denial of service vulnerability is present in some HTTP servers). Macos bitwarden. Red Hat Security Team had assigned a CVE ID to this flaw CVE-2012-5568; Environment. Red Hat JBoss Application Platform (EAP) 5.x; 6.x; 7.x; Red Hat JBoss Enterprise Web Server (EWS) Apache Tomcat.

Denial

Tomcat Slow Http Denial Of Service Attack

Denial

Remediation

The password hashing implementation must be fixed to limit the maximum length of accepted passwords.

References

Related Vulnerabilities

Severity

High

Classification

Slow Http Denial Of Service Attack Tomcat Server

CWE-400CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Slow Http Denial Of Service Attack Tomcat Code

Denial Of Service