| Vigil@nce describes vulnerabilities impacting your systems, and offers solutions to correct them. |
|
 |
|
|
|
vulnerability alert 9411
ModSecurity: denials of service
Synthesis of the vulnerability
| An attacker can generate several denials of service in the ModSecurity module for Apache httpd. |
Severity: 2/4.
Consequences: denial of service of service.
Provenance: internet client.
Means of attack: no proof of concept, no attack.
Ability of attacker: expert (4/4).
Confidence: confirmed by the editor (5/5).
Diffusion of the vulnerable configuration: high (3/3).
Number of vulnerabilities in this bulletin: 4.
Creation date: 08/02/2010.
|
Impacted products
Description of the vulnerability
The ModSecurity module can be installed on Apache httpd, in order to filter queries. It is impacted by several vulnerabilities.
An attacker can use a complex url, in order to force the regular expression engine to consume resources. [severity:2/4; >]
ModSecurity does not detect complex path exiting from the root. [severity:2/4; >]
Some MIME multipart separators are not correctly analyzed. [severity:2/4; >]
An attacker can use a malformed cookie, in order to generate a memory leak during its analysis. [severity:2/4; >]
A remote attacker can therefore generate a denial of service on ModSecurity. |
Characteristics
Title: ModSecurity: denials of service
Identifiers: BID-38156, FEDORA-2010-1862, FEDORA-2010-1903, MDVSA-2010:050, VIGILANCE-VUL-9411.
Url: https://vigilance.fr/tree/1/9411
|
Information sources
Solutions for this vulnerability
Supplements
Vulnerability : PCRE
An attacker can use a complex url, in order to force the regular expression engine to consume resources.
Severity: 2/4.
|
|
Vulnerability : path normalization
ModSecurity does not detect complex path exiting from the root.
Severity: 2/4.
|
|
Vulnerability : multipart
Some MIME multipart separators are not correctly analyzed.
Severity: 2/4.
|
|
Vulnerability : cookie parser
An attacker can use a malformed cookie, in order to generate a memory leak during its analysis.
Severity: 2/4.
|
|
|
