The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapost request with a missing part header name, which triggers a NULL pointer dereference.

According to its banner, the version of ModSecurity installed on the remote host is earlier than 2.5.9.  It is, therefore, potentially affected by a denial of service vulnerability.  An error exists related to multipart form HTTP POST requests with a missing part header name that could allow an attacker to crash the application. 

According to its banner, the version of ModSecurity installed on the remote host is earlier than 2.5.9. It is, therefore, potentially affected by a denial of service vulnerability. An error exists related to multipart form HTTP POST requests with a missing part header name that could allow an attacker to crash the application.

Note that Nessus has not tested for this issue but has instead relied only on the version in the server's banner.

The remote host is affected by the vulnerability described in GLSA-200907-02 (ModSecurity: Denial of Service)

    Multiple vulnerabilities were discovered in ModSecurity:
    Juan Galiana Lara of ISecAuditors discovered a NULL pointer     dereference when processing multipart requests without a part header     name (CVE-2009-1902).
    Steve Grubb of Red Hat reported that the     'PDF XSS protection' feature does not properly handle HTTP requests to     a PDF file that do not use the GET method (CVE-2009-1903).
  Impact :

    A remote attacker might send requests containing specially crafted     multipart data or send certain requests to access a PDF file, possibly     resulting in a Denial of Service (crash) of the Apache HTTP daemon.
    NOTE: The PDF XSS protection is not enabled by default.
  Workaround :

    There is no known workaround at this time.

Security fixes for potential denials of service when using PDF XSS protection as well as when parsing multipart requests.
http://sourceforge.net/project/shownotes.php?release_id=667542&group_i d=68846

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
6989	ModSecurity < 2.5.9 Multipart Request Header Name DoS	Nessus Network Monitor	Web Servers	high
67125	ModSecurity < 2.5.9 Multipart Request Header Name DoS	Nessus	Firewalls	high
39596	GLSA-200907-02 : ModSecurity: Denial of Service	Nessus	Gentoo Local Security Checks	high
37482	Fedora 10 : mod_security-2.5.9-1.fc10 (2009-2686)	Nessus	Fedora Local Security Checks	high
35926	Fedora 9 : mod_security-2.5.9-1.fc9 (2009-2654)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2009-1902

high

Tenable Plugins

high

high

high

high

high