Actu
Vigil@nce: ModSecurity, denials of service
March 2009 by Vigil@nce
SYNTHESIS OF THE VULNERABILITY
An attacker can create two denials of service in Apache httpd via
the ModSecurity module.
Gravity: 2/4
Consequences: denial of service of service
Provenance: internet client
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: high (3/3)
Number of vulnerabilities in this bulletin: 2
Creation date: 12/03/2009
IMPACTED PRODUCTS
– Apache httpd
– Fedora
– Unix - plateform
DESCRIPTION OF THE VULNERABILITY
The mod_security module of Apache httpd checks queries in order to
secure the service. It is impacted by two denials of service.
When the web server hosts a PDF document, the attacker can use a
query without GET to force a NULL pointer to be dereferenced in
order to stop the httpd process. [grav:2/4]
An attacker can use a multipart query, with a missing header, in
order to stop httpd. [grav:2/4]
CHARACTERISTICS
Identifiers: BID-34096, FEDORA-2009-2654, FEDORA-2009-2686,
SUSE-SA:2009:012, VIGILANCE-VUL-8535
http://vigilance.fr/vulnerability/ModSecurity-denials-of-service-8535
