Slowloris HTTP DoS in IBM DOORS Web Access

Executive Summary

IBM Engineering Requirements Management DOORS and DOORS Web Access versions 9.7.2.1 through 9.7.2.11 and 9.6.1.1 through 9.6.1.13 are vulnerable to a Slowloris HTTP denial of service attack. This occurs because the software does not limit connection length, allowing attackers to keep many connections open without completing requests, making the web server unresponsive.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a Slowloris HTTP denial of service attack due to unchecked connection lengths. Detection requires monitoring for unusually long HTTP connections or high numbers of half-open connections. Use network monitoring tools like netstat to check for excessive connections from a single IP. Commands like 'netstat -an | grep :80 | awk '{print $5}' | sort | uniq -c | sort -nr' can help identify suspicious activity.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the IBM DOORS or DOORS Web Access server to become unresponsive or crash due to excessive open connections. This disrupts access to critical engineering requirements management tools, potentially halting development or compliance workflows.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a denial of service issue affecting system availability rather than data confidentiality or integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation includes limiting connection lengths and implementing rate limiting on the web server. Configure your web server (e.g., Apache or Nginx) to enforce connection timeouts and restrict the number of simultaneous connections per IP. Update to the latest patched versions of IBM DOORS and DOORS Web Access if available.

Useful 0 Not Useful 0