CVE-2007-1359 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2007-1359
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2007-1359

Description: Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ (0x00) byte, which mod_security treats as a terminator even though it is still processed as normal data by some HTTP parsers including PHP 5.2.0, and possibly parsers in Perl, and Python.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/32872 SAID Secunia Advisory: SA24373 Secunia Advisory: SA25316 Secunia Advisory: SA31113 Secunia Advisory: SA31087 OSVDB 32778 MISC http://www.php-security.org/MOPB/BONUS-12-2007.html HP http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143 GENTOO http://www.gentoo.org/security/en/glsa/glsa-200705-17.xml CONFIRM http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2008.html http://www.modsecurity.org/blog/archives/2007/03/modsecurity_asc.html BID 22831

Return to the previous page.