diff mbox series

httpd: Load reqtimeout_module for CVE-2007-6750

Message ID 20261107221042.3185967-2-adolf.belka@ipfire.org
State New
Headers
Series httpd: Load reqtimeout_module for CVE-2007-6750 |

Commit Message

Adolf Belka 7 Nov 2026, 10:10 p.m. UTC 
- In 2010 apache version 2.2.15 was issued to deal with CVE-2007-6750. Looking at the
   commit this version was a version update and not seen as a CVE fix. The 2.2.15
   version provided the reqtimeout_module and it was provided in the apache rootfile.
- However it was never added into the loadmodule.conf file and so has never been
   implemented in IPFire.
- A user in the forum flagged this up as an output from an nmap scan that had been run.
- Ran the nmap scan and confirmed that it flagged up the slowloris vulnerability.
- Added the module into loadmodule.conf and tested it in a vm and re-ran the nmap scan
   and notrhing was flagged up.
- Although this has been present for 16 years, the fact that by default the WUI can not
   be accessed remotely from the internet and we recommend not to do that likely means
   that this vulnerability has not beenexposed into the internet.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/httpd/loadmodule.conf | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/config/httpd/loadmodule.conf b/config/httpd/loadmodule.conf
index 4947a8a21..4e44feb5a 100644
--- a/config/httpd/loadmodule.conf
+++ b/config/httpd/loadmodule.conf
@@ -52,3 +52,4 @@  LoadModule alias_module /usr/lib/apache/mod_alias.so
 LoadModule rewrite_module /usr/lib/apache/mod_rewrite.so
 LoadModule socache_shmcb_module /usr/lib/apache/mod_socache_shmcb.so
 LoadModule ssl_module /usr/lib/apache/mod_ssl.so
+LoadModule reqtimeout_module /usr/lib/apache/mod_reqtimeout.so