Vulnerability Note VU#779438

ModSecurity for Apache vulnerable to off-by-one overflow when directive "SecFilterScanPost" is enabled

Overview

A vulnerability in the mod_security module for Apache may permit a remote attacker to execute arbitrary code on the vulnerable web server.

I. Description

ModSecurity is an open source intrusion detection and prevention engine for web applications. The mod_security module for Apache 2.0.X contains an off-by-one buffer overflow vulnerabililty in the code that scans incoming POST requests. The module will scan incoming POST requests when the directive "SecFilterScanPost" is enabled. Systems with this directive disabled are not vulnerable.

II. Impact

A remote attacker may be able to execute arbitrary code on the web server with the privileges of the Apache process.

III. Solution

This issue is resolved in mod_security version 1.7.5.

Systems Affected

Vendor	Status	Date Notified	Date Updated
ModSecurity	Vulnerable	18-Mar-2004

References

http://www.modsecurity.org
http://www.s-quadra.com/advisories/Adv-20040315.txt

Credit

Thanks to S-Quadra Security Research for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

Date Public:	2004-02-16
Date First Published:	2004-03-23
Date Last Updated:	2004-04-01
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	11.95
Document Revision:	6

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader