The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method.

The remote host is affected by the vulnerability described in GLSA-200907-02 (ModSecurity: Denial of Service)

    Multiple vulnerabilities were discovered in ModSecurity:
    Juan Galiana Lara of ISecAuditors discovered a NULL pointer     dereference when processing multipart requests without a part header     name (CVE-2009-1902).
    Steve Grubb of Red Hat reported that the     'PDF XSS protection' feature does not properly handle HTTP requests to     a PDF file that do not use the GET method (CVE-2009-1903).
  Impact :

    A remote attacker might send requests containing specially crafted     multipart data or send certain requests to access a PDF file, possibly     resulting in a Denial of Service (crash) of the Apache HTTP daemon.
    NOTE: The PDF XSS protection is not enabled by default.
  Workaround :

    There is no known workaround at this time.

Security fixes for potential denials of service when using PDF XSS protection as well as when parsing multipart requests.
http://sourceforge.net/project/shownotes.php?release_id=667542&group_i d=68846

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
39596	GLSA-200907-02 : ModSecurity: Denial of Service	Nessus	Gentoo Local Security Checks	high
37482	Fedora 10 : mod_security-2.5.9-1.fc10 (2009-2686)	Nessus	Fedora Local Security Checks	high
35926	Fedora 9 : mod_security-2.5.9-1.fc9 (2009-2654)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2009-1903

high

Tenable Plugins

high

high

high