Vulnerability Note VU#779438

ModSecurity for Apache vulnerable to off-by-one overflow when directive "SecFilterScanPost" is enabled

Original Release date: 23 Mar 2004 | Last revised: 01 Apr 2004


A vulnerability in the mod_security module for Apache may permit a remote attacker to execute arbitrary code on the vulnerable web server.


ModSecurity is an open source intrusion detection and prevention engine for web applications. The mod_security module for Apache 2.0.X contains an off-by-one buffer overflow vulnerabililty in the code that scans incoming POST requests. The module will scan incoming POST requests when the directive "SecFilterScanPost" is enabled. Systems with this directive disabled are not vulnerable.


A remote attacker may be able to execute arbitrary code on the web server with the privileges of the Apache process.


This issue is resolved in mod_security version 1.7.5.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
ModSecurityAffected-18 Mar 2004
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A



Thanks to S-Quadra Security Research for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

  • CVE IDs: Unknown
  • Date Public: 16 Feb 2004
  • Date First Published: 23 Mar 2004
  • Date Last Updated: 01 Apr 2004
  • Severity Metric: 11.95
  • Document Revision: 6


If you have feedback, comments, or additional information about this vulnerability, please send us email.