UTM & Qualys Guard PCI-DSS scan ?

THREAT:
The web application is possibly vulnerable to a "slow HTTP POST" Denial of Service (DoS) attack. This is an application-level DoS that consumes
server resources by maintaining open connections for an extended period of time by slowly sending traffic to the server. If the server maintains too
many connections open at once, then it may not be able to respond to new, legitimate connections. Unlike bandwidth-consumption DoS attacks, the
"slow" attack does not require a large amount of traffic to be sent to the server -- only that the client is able to maintain open connections for several
minutes at a time.
The attack holds server connections open by sending properly crafted HTTP POST headers that contain a Content-Length header with a large value
to inform the web server how much of data to expect. After the HTTP POST headers are fully sent, the HTTP POST message body is sent at slow
speeds to prolong the completion of the connection and lock up server resources. By waiting for the complete request body, the server is helping
clients with slow or intermittent connections to complete requests, but is also exposing itself to abuse.
More information can be found at the in this presentation
(https://media.blackhat.com/bh-dc-11/Brennan/BlackHat_DC_2011_Brennan_Denial_Service-Slides.pdf).
IMPACT:
All other services remain intact but the web server itself becomes inaccessible.
SOLUTION:
Solution would be server-specific, but general recommendations are:
- to limit the size of the acceptable request to each form requirements
- establish minimal acceptable speed rate
- establish absolute request timeout for connection with POST request
Server-specific details can be found here (https://community.qualys.com/blogs/securitylabs/2011/11/02/how-to-protect-against-slow-http-attacks).
A tool that demonstrates this vulnerability in a more intrusive manner is available here (slowhttptest - Application Layer DoS attack simulator - Google Project Hosting).
COMPLIANCE:
Not Applicable
EXPLOITABILITY:
There is no exploitability information for this vulnerability.
ASSOCIATED MALWARE:
There is no malware information for this vulnerability.
RESULTS:
url: http://172.16.*.*/
matched: Vulnerable to slow HTTP POST attack
Connection with partial POST body remained open for: 305121 milliseconds

Found the same problem on my implementation of sophos UTM.

Did you find solution about how to remediate the vulnerability?

Found the same problem on my implementation of sophos UTM.

Did you find solution about how to remediate the vulnerability?

Omner, I think you just need to get Sophos Support involved.  I suspect it's a false positive, but Support probably already has a document they can send you to retrieve.  I hope our posting on his thread gets him back here!

Cheers - Bob