5

CVE-2013-2765

Exploit
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Trustwave ≫ Modsecurity Version < 2.7.4
   Apache ≫ HTTP Server
Opensuse ≫ Opensuse Version11.4
Opensuse ≫ Opensuse Version12.2
Opensuse ≫ Opensuse Version12.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 13.72% 0.96
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

http://www.modsecurity.org/
Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html
Third Party Advisory
Mailing List
http://archives.neohapsis.com/archives/bugtraq/2013-05/0125.html
Broken Link
http://sourceforge.net/mailarchive/message.php?msg_id=30900019
Third Party Advisory
http://www.shookalabs.com/
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=967615
Patch
Third Party Advisory
Issue Tracking
https://github.com/SpiderLabs/ModSecurity/commit/0840b13612a0b7ef1ce7441cf811dcfc6b463fba
Patch
Third Party Advisory
https://github.com/shookalabs/exploits/blob/master/modsecurity_cve_2013_2765_check.py
Third Party Advisory
Exploit
https://raw.github.com/SpiderLabs/ModSecurity/master/CHANGES
Broken Link