Apache Mod_Security Module Heap Corruption Vulnerability
BID:8919
Info
Apache Mod_Security Module Heap Corruption Vulnerability
| Bugtraq ID: | 8919 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 28 2003 12:00AM |
| Updated: | Oct 28 2003 12:00AM |
| Credit: | The discovery of this vulnerability has been credited to Adam Dyga <[email protected]>. |
| Vulnerable: |
mod_security mod_security 1.7.1 mod_security mod_security 1.7 |
| Not Vulnerable: |
mod_security mod_security 1.7.2 |
Discussion
Apache Mod_Security Module Heap Corruption Vulnerability
A vulnerability has been discovered in the mod_security Apache 2 module. The problem occurs while handling large amounts of data transfered via server-side scripts. Due to insufficient bounds checking when handling the data, it may be possible for a malicious script to cause heap memory be to corrupted. This could potentially allow for the execution of arbitrary code with the privileges of the Apache web server.
It should be emphasized that the condition cannot occur by transmitting large amounts of memory to the affected server. The malicious data must be sent out from the server in order for the vulnerability to be triggered.
A vulnerability has been discovered in the mod_security Apache 2 module. The problem occurs while handling large amounts of data transfered via server-side scripts. Due to insufficient bounds checking when handling the data, it may be possible for a malicious script to cause heap memory be to corrupted. This could potentially allow for the execution of arbitrary code with the privileges of the Apache web server.
It should be emphasized that the condition cannot occur by transmitting large amounts of memory to the affected server. The malicious data must be sent out from the server in order for the vulnerability to be triggered.
Exploit / POC
Apache Mod_Security Module Heap Corruption Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Apache Mod_Security Module Heap Corruption Vulnerability
Solution:
This vulnerability has been addressed in mod_security 1.7.2, which is available below:
mod_security mod_security 1.7
mod_security mod_security 1.7.1
Solution:
This vulnerability has been addressed in mod_security 1.7.2, which is available below:
mod_security mod_security 1.7
-
mod_security mod_security-1.7.2.tar.gz
http://www.modsecurity.org/download/mod_security-1.7.2.tar.gz
mod_security mod_security 1.7.1
-
mod_security mod_security-1.7.2.tar.gz
http://www.modsecurity.org/download/mod_security-1.7.2.tar.gz
References
Apache Mod_Security Module Heap Corruption Vulnerability
References:
References:
- mod_security Home Page (mod_security)
- mod_security 1.7RC1 to 1.7.1 vulnerability (Adam Dyga