Vulnerability Note VU#779438

Overview

A vulnerability in the mod_security module for Apache may permit a remote attacker to execute arbitrary code on the vulnerable web server.

Description

ModSecurity is an open source intrusion detection and prevention engine for web applications. The mod_security module for Apache 2.0.X contains an off-by-one buffer overflow vulnerabililty in the code that scans incoming POST requests. The module will scan incoming POST requests when the directive "SecFilterScanPost" is enabled. Systems with this directive disabled are not vulnerable.

Impact

A remote attacker may be able to execute arbitrary code on the web server with the privileges of the Apache process.

Solution

This issue is resolved in mod_security version 1.7.5.

Systems Affected (Learn More)

Vendor	Status	Date Notified	Date Updated
ModSecurity	Affected	-	18 Mar 2004

If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group	Score	Vector
Base	N/A	N/A
Temporal	N/A	N/A
Environmental	N/A	N/A

References

• http://www.modsecurity.org
• http://www.s-quadra.com/advisories/Adv-20040315.txt

Credit

Thanks to S-Quadra Security Research for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

• CVE IDs: Unknown
• Date Public: 16 Feb 2004
• Date First Published: 23 Mar 2004
• Date Last Updated: 01 Apr 2004
• Severity Metric: 11.95
• Document Revision: 6