Bug 1082904 (CVE-2013-5705)

Summary:	CVE-2013-5705 mod_security: bypass of intended rules via chunked requests
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	athmanem, carnil, dkopecek, hannsj_uhl, jrusnack, pfrields, pvrabec
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mod_security 2.7.6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-29 13:56:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1082905, 1082906, 1082907
Bug Blocks:

Description Murray McAllister 2014-04-01 04:54:44 UTC

Martin Holst Swende discovered a flaw in the way mod_security handled chunked requests. A remote attacker could use this flaw to bypass intended mod_security restrictions, allowing them to send requests containing content that should have been removed by mod_security.

This issue was corrected in mod_security version 2.7.6.

Upstream patch: https://github.com/SpiderLabs/ModSecurity/commit/f8d441cd25172fdfe5b613442fedfc0da3cc333d

References:

http://martin.swende.se/blog/HTTPChunked.html

Comment 1 Murray McAllister 2014-04-01 05:00:53 UTC

Created mod_security tracking bugs for this issue:

Affects: fedora-all [bug 1082905]
Affects: epel-all [bug 1082906]

Comment 3 Fedora Update System 2014-04-14 22:33:48 UTC

mod_security-2.7.5-3.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2014-04-14 22:41:22 UTC

mod_security-2.7.5-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2014-04-17 19:42:27 UTC

mod_security-2.6.8-5.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2014-04-17 19:42:45 UTC

mod_security-2.7.3-3.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.