The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.

The remote Solaris system is missing necessary patches to address security updates :

  - The ModSecurity module before 2.7.4 for the Apache HTTP     Server allows remote attackers to cause a denial of     service (NULL pointer dereference, process crash, and     disk consumption) via a POST request with a large body     and a crafted Content-Type header. (CVE-2013-2765)

- complete overhaul of this package, with update to 2.7.5.

  - ruleset update to 2.2.8-0-g0f07cbb.

  - new configuration framework private to mod_security2:
    /etc/apache2/conf.d/mod_security2.conf loads     /usr/share/apache2-mod_security2/rules/modsecurity_crs_1     0_setup.conf, then /etc/apache2/mod_security2.d/*.conf ,     as set up based on advice in     /etc/apache2/conf.d/mod_security2.conf Your     configuration starting point is     /etc/apache2/conf.d/mod_security2.conf

  - !!! Please note that mod_unique_id is needed for     mod_security2 to run!

  - modsecurity-apache_2.7.5-build_fix_pcre.diff changes     erroneaous linker parameter, preventing rpath in shared     object.

  - fixes contained for the following bugs :

  - CVE-2009-5031, CVE-2012-2751 [bnc#768293] request     parameter handling

  - [bnc#768293] multi-part bypass, minor threat

  - CVE-2013-1915 [bnc#813190] XML external entity     vulnerability

  - CVE-2012-4528 [bnc#789393] rule bypass

  - CVE-2013-2765 [bnc#822664] NULL pointer dereference     crash

  - new from 2.5.9 to 2.7.5, only major changes :

  - GPLv2 replaced by Apache License v2

  - rules are not part of the source tarball any longer, but     maintaned upstream externally, and included in this     package.

  - documentation was externalized to a wiki. Package     contains the FAQ and the reference manual in html form.

  - renamed the term 'Encryption' in directives that     actually refer to hashes. See CHANGES file for more     details.

  - new directive SecXmlExternalEntity, default off

  - byte conversion issues on s390x when logging fixed.

  - many small issues fixed that were discovered by a     Coverity scanner

  - updated reference manual

  - wrong time calculation when logging for some timezones     fixed.

  - replaced time-measuring mechanism with finer granularity     for measured request/answer phases. (Stopwatch remains     for compat.)

  - cookie parser memory leak fix

  - parsing of quoted strings in multipart     Content-Disposition headers fixed.

  - SDBM deadlock fix

  - @rsub memory leak fix

  - cookie separator code improvements

  - build failure fixes

  - compile time option --enable-htaccess-config (set)

- complete overhaul of this package, with update to 2.7.5.

  - ruleset update to 2.2.8-0-g0f07cbb. 

  - new configuration framework private to mod_security2:
    /etc/apache2/conf.d/mod_security2.conf loads     /usr/share/apache2-mod_security2/rules/modsecurity_crs_1     0_setup.conf, then /etc/apache2/mod_security2.d/*.conf ,     as set up based on advice in     /etc/apache2/conf.d/mod_security2.conf Your     configuration starting point is     /etc/apache2/conf.d/mod_security2.conf

  - !!! Please note that mod_unique_id is needed for     mod_security2 to run!

  - modsecurity-apache_2.7.5-build_fix_pcre.diff changes     erroneaous linker parameter, preventing rpath in shared     object.

  - fixes contained for the following bugs :

  - CVE-2009-5031, CVE-2012-2751 [bnc#768293] request     parameter handling

  - [bnc#768293] multi-part bypass, minor threat

  - CVE-2013-1915 [bnc#813190] XML external entity     vulnerability

  - CVE-2012-4528 [bnc#789393] rule bypass

  - CVE-2013-2765 [bnc#822664] NULL pointer dereference     crash

  - new from 2.5.9 to 2.7.5, only major changes :

  - GPLv2 replaced by Apache License v2

  - rules are not part of the source tarball any longer, but     maintaned upstream externally, and included in this     package.

  - documentation was externalized to a wiki. Package     contains the FAQ and the reference manual in html form.

  - renamed the term 'Encryption' in directives that     actually refer to hashes. See CHANGES file for more     details.

  - new directive SecXmlExternalEntity, default off

  - byte conversion issues on s390x when logging fixed.

  - many small issues fixed that were discovered by a     Coverity scanner

  - updated reference manual

  - wrong time calculation when logging for some timezones     fixed.

  - replaced time-measuring mechanism with finer granularity     for measured request/answer phases. (Stopwatch remains     for compat.)

  - cookie parser memory leak fix

  - parsing of quoted strings in multipart     Content-Disposition headers fixed.

  - SDBM deadlock fix

  - @rsub memory leak fix

  - cookie separator code improvements

  - build failure fixes

  - compile time option --enable-htaccess-config (set)

This update of mod_security2 fixed a NULL pointer dereference crash (CVE-2013-2765) and a memory issue (double free()). (bnc#822664)

Updated apache-mod_security packages fix security vulnerability :

When ModSecurity receives a request body with a size bigger than the value set by the SecRequestBodyInMemoryLimit and with a Content-Type that has no request body processor mapped to it, ModSecurity will systematically crash on every call to forceRequestBodyVariable (in phase 1) (CVE-2013-2765).

According to its banner, the version of ModSecurity installed on the remote host is earlier than 2.7.4. It is, therefore, potentially affected by a denial of service vulnerability. An error exists related to handling the action 'forceRequestBodyVariable' that could allow an HTTP request to cause a NULL pointer to be dereferenced and an application crash.

Note that Nessus has not tested for this issue but has instead relied only on the version in the server's banner.

SecurityFocus reports :

When ModSecurity receives a request body with a size bigger than the value set by the 'SecRequestBodyInMemoryLimit' and with a 'Content-Type' that has no request body processor mapped to it, ModSecurity will systematically crash on every call to 'forceRequestBodyVariable'.

ID	Name	Product	Family	Severity
80587	Oracle Solaris Third-Party Patch Update : apache (cve_2013_2765_denial_of)	Nessus	Solaris Local Security Checks	medium
75113	openSUSE Security Update : apache2-mod_security2 (openSUSE-SU-2013:1331-1)	Nessus	SuSE Local Security Checks	high
75112	openSUSE Security Update : apache2-mod_security2 (openSUSE-SU-2013:1336-1)	Nessus	SuSE Local Security Checks	high
69787	SuSE 11.3 Security Update : apache2-mod_security2 (SAT Patch Number 8149)	Nessus	SuSE Local Security Checks	medium
67132	Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2013:187)	Nessus	Mandriva Local Security Checks	medium
67128	ModSecurity < 2.7.4 forceRequestBodyVariable Action Handling DoS	Nessus	Firewalls	medium
66770	FreeBSD : www/mod_security -- NULL pointer dereference DoS (9dfb63b8-8f36-11e2-b34d-000c2957946c)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-2765

high

Tenable Plugins

medium

high

high

medium

medium

medium

medium