ModSecurity <= 2.6.8 is vulnerable to multipart/invalid part ruleset bypass, this was fixed in 2.7.0 (released on2012-10-16) http://seclists.org/fulldisclosure/2012/Oct/113 CVE request: http://www.openwall.com/lists/oss-security/2012/10/17/1 Packages in EPEL and Fedora are affected, update will be released today.
Thank you for your report, Athmane.
Relevant upstream patch seems to be this one: [1] http://mod-security.svn.sourceforge.net/viewvc/mod-security?view=revision&sortby=date&revision=2081 but checking with Breno Silva yet: [2] http://www.openwall.com/lists/oss-security/2012/10/18/7 to confirm / disprove it.
References: [3] http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.7.x/CHANGES
This issue affects the versions of the mod_security package, as shipped with Fedora release of 16 and 17. Please schedule an update. -- This issue affects the versions of the mod_security package, as shipped with Fedora EPEL 5 and Fedora EPEL 6. Please schedule an update.
Created mod_security tracking bugs for this issue Affects: fedora-all [bug 867773] Affects: epel-all [bug 867774]
Above patch confirmed by Breno Silva (that reply doesn't look to be able to make it to OSS list yet, inlining below): -- Hello Jan, Yes i can confirm the issue and the patch. Thanks Breno -- Please schedule the updates.
This was assigned CVE-2012-4528: http://www.openwall.com/lists/oss-security/2012/10/18/14
mod_security_crs-2.2.6-3.fc18, mod_security-2.7.1-3.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
mod_security_crs-2.2.6-3.fc17, mod_security-2.7.1-3.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
mod_security-2.6.8-2.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
mod_security-2.7.1-3.el6, mod_security_crs-2.2.6-3.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.