PT-2007-2754 · Trustwave+1 · Modsecurity+1

Stefan Esser · Published 2007-03-08 · Updated 2017-07-29 · CVE-2007-1359

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ModSecurity (mod security) versions 2.1.0 and earlier

Description The issue arises from an interpretation conflict in ModSecurity, where remote attackers can bypass request rules by sending application/x-www-form-urlencoded POST data containing an ASCIIZ (0x00) byte. This byte is treated as a terminator by ModSecurity, but it is still processed as normal data by some HTTP parsers, including PHP 5.2.0, and possibly parsers in Perl and Python.

Recommendations For ModSecurity (mod security) versions 2.1.0 and earlier, update to a version later than 2.1.0 to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2007-1359

Affected Products

Modsecurity

Php

References · 17

• 🔥 https://exploit-db.com/exploits/3425 · Exploit
• 🔥 http://php-security.org/MOPB/BONUS-12-2007.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1359 · Security Note
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143 · Vendor Advisory
• http://secunia.com/advisories/24373 · Vendor Advisory
• http://securityfocus.com/bid/22831 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200705-17.xml · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32872 · Note
• http://modsecurity.org/blog/archives/2007/03/modsecurity_asc.html · Note
• http://oracle.com/technetwork/topics/security/cpujul2008-090335.html · Note
• http://secunia.com/advisories/31087 · Note
• http://vupen.com/english/advisories/2008/2115 · Note
• http://osvdb.org/32778 · Note
• http://secunia.com/advisories/25316 · Note
• http://vupen.com/english/advisories/2008/2109/references · Note