ModSecurity 1.7.4 for Apache 2.x remote off-by-one overflow

From: S-Quadra Security Research (research_at_s-quadra.com)
Date: 03/16/04

  • Next message: Angelo Rosiello: "Crafty Game Stack Overflow & Exploit"
    Date: Tue, 16 Mar 2004 13:52:30 +0300
    To: full-disclosure <full-disclosure@lists.netsys.com>, bugtraq <bugtraq@securityfocus.com>
    
    

                    S-Quadra Advisory #2004-03-15

    Topic: ModSecurity 1.7.4 for Apache 2.x remote off-by-one overflow
    Severity: Average
    Vendor URL: http://www.modsecurity.org
    Advisory URL: http://www.s-quadra.com/advisories/Adv-20040315.txt
    Release date: 15 Mar 2004

    1. DESCRIPTION

    ModSecurity is an open source intrusion detection and prevention engine
    for web applications. It supports both branches of the Apache web
    server. Please visit http://www.modsecurity.org for more information
    about ModSecurity.

    2. DETAILS

    When directive "SecFilterScanPost" is enabled, ModSecurity checks
    incoming POST payloads. In this mode Apache 2.x version of ModSecurity
    is vulnerable to off-by-one overflow which could be potentially used by
    a remote attacker to execute arbitrary code on a target's web server.

    3. FIX INFORMATION

    S-Quadra alerted Ivan Ristic (ModSecurity developer) on this issue 09
    Feb 2004. Mod_security 1.7.5 which fixes this issue is available.

    4. CREDITS

    Evgeny Legerov <e.legerov@s-quadra.com> is responsible for discovering
    this issue.

    5. ABOUT

    S-Quadra dedicates its substantial knowledge and resources to managing
    clients' IT security risks. S-Quadra audits and protection for software
    and networks implement pioneering methods and ground-breaking
    technologies.

                    S-Quadra Advisory #2004-03-15


  • Next message: Angelo Rosiello: "Crafty Game Stack Overflow & Exploit"

    Relevant Pages