is tomcat 6.0.35 vulnerable to CVE-2007-6750?

Question

I don't know if this is the correct list but it seem to be the best one.

I'm trying to find evidence of whether tomcat 6.0.35 is vulnerable (and if so, was it fixed and in which version?) to the issue identified in CVE-2007-6750?

"The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15."

I found a single statement on https://bugzilla.redhat.com/show_bug.cgi?id=880011 that says Tomcat is affected but I haven't found any published fix from RH or any confirmation on tomcat.apache.org website.

Any info would be great.

Answer 1

Note that, officially, CVE-2007-6750 is against Apache httpd, and no other product. Technically, CVE-2007-6750 cannot be applied to Tomcat.

On the other hand, the technique used for a DOS (Slowloris) can definitely be used to DOS Tomcat under certain configurations. Technically, this is tracked via a separate CVE issue:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5568 (which you should have found from RedHat's Bugzilla entry).

To (partially) mitigate Slowloris, use the NIO connector with an appropriate connectionTimeout configured.

confirmation on tomcat -
http://tomcat.apache.org/security-7.html#Not_a_vulnerability_in_Tomcat