apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.

Updated apache-mod_security packages fix security vulnerability :

Martin Holst Swende discovered a flaw in the way mod_security handled chunked requests. A remote attacker could use this flaw to bypass intended mod_security restrictions, allowing them to send requests containing content that should have been removed by mod_security (CVE-2013-5705).

Martin Holst Swende discovered a flaw in the way mod_security handled chunked requests. A remote attacker could use this flaw to bypass intended mod_security restrictions, allowing them to send requests containing content that should have been removed by mod_security.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is apache2-mod_security2 update fixes the following security issue :

  - Specially drafted chunked http requests allow to bypass     filters configured in mod_security2. This vulnerability     is known as CVE-2013-5705 and was handled in bnc#871309.

This apache2-mod_security2 update fixes the following security issue :

  - bypass of intended rules via chunked requests     (CVE-2013-5705). (bnc#871309)

Martin Holst Swende discovered a flaw in the way chunked requests are handled in ModSecurity, an Apache module whose purpose is to tighten the Web application security. A remote attacker could use this flaw to bypass intended mod_security restrictions by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header, allowing to send requests containing content that should have been removed by mod_security.

According to its banner, the version of ModSecurity installed on the remote host is prior to 2.7.6. It is, therefore, potentially affected by a filter bypass vulnerability.

A filter bypass vulnerability exists with 'modsecurity.c' not properly handling chunked requests. A remote attacker, with a specially crafted request, can bypass security filters and inject arbitrary content.

Note that Nessus has not tested for this issue but has instead relied only on the version in the server's banner.

Fix Chunked string case sensitive issue (CVE-2013-5705, RHBZ #1082904 #1082905 #1082906)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
82359	Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2015:106)	Nessus	Mandriva Local Security Checks	medium
82182	Debian DLA-34-1 : libapache-mod-security security update	Nessus	Debian Local Security Checks	medium
78278	Amazon Linux AMI : mod_security (ALAS-2014-335)	Nessus	Amazon Linux Local Security Checks	medium
78277	Amazon Linux AMI : mod24_security (ALAS-2014-334)	Nessus	Amazon Linux Local Security Checks	medium
77290	openSUSE Security Update : apache2-mod_security2 (openSUSE-SU-2014:1047-1)	Nessus	SuSE Local Security Checks	medium
77099	SuSE 11.3 Security Update : apache2-mod_security2 (SAT Patch Number 9585)	Nessus	SuSE Local Security Checks	medium
76858	Debian DSA-2991-1 : modsecurity-apache - security update	Nessus	Debian Local Security Checks	medium
73962	ModSecurity < 2.7.6 Chunked Header Filter Bypass	Nessus	Firewalls	medium
73932	Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2014:081)	Nessus	Mandriva Local Security Checks	medium
73507	Fedora 19 : mod_security-2.7.5-3.fc19 (2014-4720)	Nessus	Fedora Local Security Checks	medium
73504	Fedora 20 : mod_security-2.7.5-3.fc20 (2014-4633)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-5705

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium