The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.

- complete overhaul of this package, with update to 2.7.5.

  - ruleset update to 2.2.8-0-g0f07cbb.

  - new configuration framework private to mod_security2:
    /etc/apache2/conf.d/mod_security2.conf loads     /usr/share/apache2-mod_security2/rules/modsecurity_crs_1     0_setup.conf, then /etc/apache2/mod_security2.d/*.conf ,     as set up based on advice in     /etc/apache2/conf.d/mod_security2.conf Your     configuration starting point is     /etc/apache2/conf.d/mod_security2.conf

  - !!! Please note that mod_unique_id is needed for     mod_security2 to run!

  - modsecurity-apache_2.7.5-build_fix_pcre.diff changes     erroneaous linker parameter, preventing rpath in shared     object.

  - fixes contained for the following bugs :

  - CVE-2009-5031, CVE-2012-2751 [bnc#768293] request     parameter handling

  - [bnc#768293] multi-part bypass, minor threat

  - CVE-2013-1915 [bnc#813190] XML external entity     vulnerability

  - CVE-2012-4528 [bnc#789393] rule bypass

  - CVE-2013-2765 [bnc#822664] NULL pointer dereference     crash

  - new from 2.5.9 to 2.7.5, only major changes :

  - GPLv2 replaced by Apache License v2

  - rules are not part of the source tarball any longer, but     maintaned upstream externally, and included in this     package.

  - documentation was externalized to a wiki. Package     contains the FAQ and the reference manual in html form.

  - renamed the term 'Encryption' in directives that     actually refer to hashes. See CHANGES file for more     details.

  - new directive SecXmlExternalEntity, default off

  - byte conversion issues on s390x when logging fixed.

  - many small issues fixed that were discovered by a     Coverity scanner

  - updated reference manual

  - wrong time calculation when logging for some timezones     fixed.

  - replaced time-measuring mechanism with finer granularity     for measured request/answer phases. (Stopwatch remains     for compat.)

  - cookie parser memory leak fix

  - parsing of quoted strings in multipart     Content-Disposition headers fixed.

  - SDBM deadlock fix

  - @rsub memory leak fix

  - cookie separator code improvements

  - build failure fixes

  - compile time option --enable-htaccess-config (set)

- complete overhaul of this package, with update to 2.7.5.

  - ruleset update to 2.2.8-0-g0f07cbb. 

  - new configuration framework private to mod_security2:
    /etc/apache2/conf.d/mod_security2.conf loads     /usr/share/apache2-mod_security2/rules/modsecurity_crs_1     0_setup.conf, then /etc/apache2/mod_security2.d/*.conf ,     as set up based on advice in     /etc/apache2/conf.d/mod_security2.conf Your     configuration starting point is     /etc/apache2/conf.d/mod_security2.conf

  - !!! Please note that mod_unique_id is needed for     mod_security2 to run!

  - modsecurity-apache_2.7.5-build_fix_pcre.diff changes     erroneaous linker parameter, preventing rpath in shared     object.

  - fixes contained for the following bugs :

  - CVE-2009-5031, CVE-2012-2751 [bnc#768293] request     parameter handling

  - [bnc#768293] multi-part bypass, minor threat

  - CVE-2013-1915 [bnc#813190] XML external entity     vulnerability

  - CVE-2012-4528 [bnc#789393] rule bypass

  - CVE-2013-2765 [bnc#822664] NULL pointer dereference     crash

  - new from 2.5.9 to 2.7.5, only major changes :

  - GPLv2 replaced by Apache License v2

  - rules are not part of the source tarball any longer, but     maintaned upstream externally, and included in this     package.

  - documentation was externalized to a wiki. Package     contains the FAQ and the reference manual in html form.

  - renamed the term 'Encryption' in directives that     actually refer to hashes. See CHANGES file for more     details.

  - new directive SecXmlExternalEntity, default off

  - byte conversion issues on s390x when logging fixed.

  - many small issues fixed that were discovered by a     Coverity scanner

  - updated reference manual

  - wrong time calculation when logging for some timezones     fixed.

  - replaced time-measuring mechanism with finer granularity     for measured request/answer phases. (Stopwatch remains     for compat.)

  - cookie parser memory leak fix

  - parsing of quoted strings in multipart     Content-Disposition headers fixed.

  - SDBM deadlock fix

  - @rsub memory leak fix

  - cookie separator code improvements

  - build failure fixes

  - compile time option --enable-htaccess-config (set)

According to its banner, the version of ModSecurity installed on the remote host is earlier than 2.7.0.  It is, therefore, potentially affected by a security bypass vulnerability.  An error exists related to HTTP POST requests and 'Content-Disposition' headers containing extra lines that could allow a remote attacker to bypass certain filters and carry out attacks. 

According to its banner, the version of ModSecurity installed on the remote host is earlier than 2.7.0. It is, therefore, potentially affected by a security bypass vulnerability. An error exists related to HTTP POST requests and 'Content-Disposition' headers containing extra lines that could allow a remote attacker to bypass certain filters and carry out attacks.

Note that Nessus has not tested for this issue but has instead relied only on the version in the server's banner.

A vulnerability has been discovered and corrected in apache-mod_security :

ModSecurity <= 2.6.8 is vulnerable to multipart/invalid part ruleset bypass, this was fixed in 2.7.0 (released on2012-10-16) (CVE-2012-4528).

The updated packages have been patched to correct this issue.

NOTE: This advisory was previousely given the MDVSA-2013:016 identifier by mistake.

Multiple vulnerabilities has been discovered and corrected in apache-mod_security :

ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031 (CVE-2012-2751).

ModSecurity <= 2.6.8 is vulnerable to multipart/invalid part ruleset bypass, this was fixed in 2.7.0 (released on2012-10-16) (CVE-2012-4528).

The updated packages have been patched to correct these issues.

- Update to 2.7.1

    - Update Core rules set to 2.2.6

    - Fix build against libxml2 >= 2.9 (upstreamed)

    - Add some missing directives RHBZ #569360

    - Fix multipart/invalid part ruleset bypass issue       (CVE-2012-4528) (RHBZ #867424, #867773, #867774)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75113	openSUSE Security Update : apache2-mod_security2 (openSUSE-SU-2013:1331-1)	Nessus	SuSE Local Security Checks	high
75112	openSUSE Security Update : apache2-mod_security2 (openSUSE-SU-2013:1336-1)	Nessus	SuSE Local Security Checks	high
6990	ModSecurity < 2.7.0 Multipart Request Parsing Filter Bypass	Nessus Network Monitor	Web Servers	medium
67126	ModSecurity < 2.7.0 Multipart Request Parsing Filter Bypass	Nessus	Firewalls	medium
66043	Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2013:029)	Nessus	Mandriva Local Security Checks	medium
63331	Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2012:182)	Nessus	Mandriva Local Security Checks	medium
63127	Fedora 17 : mod_security-2.7.1-3.fc17 / mod_security_crs-2.2.6-3.fc17 (2012-18315)	Nessus	Fedora Local Security Checks	medium
63037	Fedora 18 : mod_security-2.7.1-3.fc18 / mod_security_crs-2.2.6-3.fc18 (2012-18278)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-4528

critical

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium