S-Quadra Advisory #2004-03-15
Topic: ModSecurity 1.7.4 for Apache 2.x remote off-by-one overflow
Vendor URL: http://www.modsecurity.org
Advisory URL: http://www.s-quadra.com/advisories/Adv-20040315.txt
Release date: 15 Mar 2004
ModSecurity is an open source intrusion detection and prevention engine for web applications.
It supports both branches of the Apache web server.
Please visit http://www.modsecurity.org
for more information about ModSecurity.
When directive "SecFilterScanPost" is enabled, ModSecurity checks incoming POST payloads.
In this mode Apache 2.x version of ModSecurity is vulnerable to off-by-one overflow which could be potentially
used by a remote attacker to execute arbitrary code on a target's web server.
3. FIX INFORMATION
S-Quadra alerted Ivan Ristic (ModSecurity developer) on this issue 09 Feb 2004.
Mod_security 1.7.5 which fixes this issue is available.
Evgeny Legerov <[email protected]
> is responsible for discovering this issue.
S-Quadra dedicates its substantial knowledge and resources to managing
clients' IT security risks. S-Quadra audits and protection for software
and networks implement pioneering methods and ground-breaking technologies.
S-Quadra Advisory #2004-12-05